@saadnvd1/agent-os 0.3.664 → 0.3.672

package/components/Chat/McpSignIn.tsx

@@ -0,0 +1,122 @@
+"use client";
+
+import { useState } from "react";
+import { ExternalLink } from "lucide-react";
+import type { useMcpSignIn } from "@/data/chat/mcpAuth";
+
+const LINK =
+  "bg-primary text-primary-foreground inline-flex h-11 items-center justify-center gap-2 rounded-lg px-4 text-sm font-medium md:h-9";
+const GHOST =
+  "text-muted-foreground hover:text-foreground h-11 rounded-lg px-3 text-xs md:h-9";
+
+// What happens after Sign in is pressed on one server: the link to open, and
+// what to do if the provider can't return to AgentOS by itself. The list row
+// turns connected on its own, over the chat socket, when it's done.
+export function McpSignIn({
+  flow: { start, finish, recheck },
+  server,
+  onClose,
+}: {
+  // Started by the Sign in press (not on mount: a dev double-mount would
+  // drop the request's result).
+  flow: ReturnType<typeof useMcpSignIn>;
+  server: string;
+  onClose: () => void;
+}) {
+  const [pasted, setPasted] = useState("");
+
+  const mode = start.data?.mode;
+  const authUrl = start.data?.authUrl;
+  const error = start.error ?? finish.error ?? recheck.error;
+  const busy = start.isPending || finish.isPending || recheck.isPending;
+
+  return (
+    <div className="space-y-2 pt-1 pr-2 pb-2 pl-6.5 text-xs">
+      {start.isPending && (
+        <p className="text-muted-foreground">Starting sign-in…</p>
+      )}
+      {mode === "done" && (
+        <p className="text-muted-foreground">
+          Already signed in; reconnecting.
+        </p>
+      )}
+      {(mode === "callback" || mode === "paste" || mode === "external") &&
+        authUrl && (
+          <div className="flex flex-wrap items-center gap-2">
+            <a
+              href={authUrl}
+              target="_blank"
+              rel="noopener noreferrer"
+              className={LINK}
+            >
+              {mode === "external" ? "Open claude.ai" : "Open sign-in page"}
+              <ExternalLink className="size-4" />
+            </a>
+            {mode === "external" && (
+              <button
+                type="button"
+                disabled={busy}
+                onClick={() => recheck.mutate()}
+                className={GHOST}
+              >
+                Check again
+              </button>
+            )}
+          </div>
+        )}
+      {mode === "callback" && (
+        <p className="text-muted-foreground">
+          Approve it there. This list updates by itself.
+        </p>
+      )}
+      {mode === "external" && (
+        <p className="text-muted-foreground">
+          This server signs in on claude.ai. Finish there, then come back.
+        </p>
+      )}
+      {mode === "paste" && (
+        <>
+          <p className="text-muted-foreground">
+            This server only sends the sign-in back to the machine running the
+            session. On this device the page you land on won&apos;t load: copy
+            its address and paste it here.
+          </p>
+          <form
+            className="flex items-center gap-2"
+            onSubmit={(e) => {
+              e.preventDefault();
+              if (pasted.trim()) finish.mutate(pasted.trim());
+            }}
+          >
+            <input
+              value={pasted}
+              onChange={(e) => setPasted(e.target.value)}
+              inputMode="url"
+              autoComplete="off"
+              autoCapitalize="off"
+              spellCheck={false}
+              placeholder="Address of the page after approving"
+              aria-label={`Address after signing in to ${server}`}
+              className="bg-background hairline h-11 min-w-0 flex-1 rounded-lg px-3 text-base md:h-9 md:text-xs"
+            />
+            <button
+              type="submit"
+              disabled={busy || !pasted.trim()}
+              className="bg-secondary text-secondary-foreground hairline h-11 shrink-0 rounded-lg px-3 text-xs font-medium disabled:opacity-50 md:h-9"
+            >
+              Finish
+            </button>
+          </form>
+        </>
+      )}
+      {error && (
+        <p className="text-destructive whitespace-pre-wrap" role="alert">
+          {error.message}
+        </p>
+      )}
+      <button type="button" onClick={onClose} className={GHOST}>
+        {error ? "Close" : "Cancel"}
+      </button>
+    </div>
+  );
+}

package/components/Chat/session.ts

@@ -0,0 +1,8 @@
+"use client";
+
+import { createContext, useContext } from "react";
+
+// The session this chat belongs to, for rows that call its API (a context,
+// not a prop through every item).
+export const ChatSessionId = createContext<string | null>(null);
+export const useChatSessionId = () => useContext(ChatSessionId);

package/components/Health/SweepRuns.tsx

@@ -17,6 +17,7 @@ const KIND: Record<string, string> = {
   database: "task database",
   spare: "dependency spare",
   temp: "temp folder",
+  "test-temp": "test temp folder",
   "derived-data": "Xcode build folder",
 };
 

package/components/Projects/ProjectSettingsDialog.tsx

@@ -12,6 +12,8 @@ import {
 import { Button } from "@/components/ui/button";
 import { Input } from "@/components/ui/input";
 import { Textarea } from "@/components/ui/textarea";
+import { ProjectTierField } from "./ProjectTierField";
+import type { ProjectTier } from "@/lib/project-tier/types";
 import {
   Select,
   SelectContent,
@@ -95,6 +97,7 @@ export function ProjectSettingsDialog({
     getDefaultModelForAgent("claude")
   );
   const [initialPrompt, setInitialPrompt] = useState("");
+  const [tier, setTier] = useState<ProjectTier>("fast");
   const [devServers, setDevServers] = useState<DevServerConfig[]>([]);
   const [repositories, setRepositories] = useState<RepositoryConfig[]>([]);
   const [isLoading, setIsLoading] = useState(false);
@@ -118,6 +121,7 @@ export function ProjectSettingsDialog({
       setName(project.name);
       setWorkingDirectory(project.working_directory);
       setAgentType(project.agent_type);
+      setTier(project.tier);
       setDefaultModel(
         isSupportedModelForAgent(project.agent_type, project.default_model)
           ? project.default_model
@@ -336,6 +340,7 @@ export function ProjectSettingsDialog({
         agentType,
         defaultModel,
         initialPrompt: initialPrompt.trim() || null,
+        tier,
       });
 
       // Handle dev server changes
@@ -526,6 +531,8 @@ export function ProjectSettingsDialog({
               </Select>
             </div>
 
+            <ProjectTierField value={tier} onChange={setTier} />
+
             {/* Initial Prompt */}
             <div className="space-y-2">
               <label className="text-sm font-medium">Initial Prompt</label>

package/components/Projects/ProjectTierField.tsx

@@ -0,0 +1,39 @@
+"use client";
+
+import {
+  Select,
+  SelectContent,
+  SelectItem,
+  SelectTrigger,
+  SelectValue,
+} from "@/components/ui/select";
+import type { ProjectTier } from "@/lib/project-tier/types";
+
+const DETAIL: Record<ProjectTier, string> = {
+  production: "CI, the independent review and scope must pass before a merge.",
+  fast: "A task's PR merges as soon as it opens: no CI wait, no review.",
+};
+
+export function ProjectTierField({
+  value,
+  onChange,
+}: {
+  value: ProjectTier;
+  onChange: (tier: ProjectTier) => void;
+}) {
+  return (
+    <div className="space-y-2">
+      <label className="text-sm font-medium">Tier</label>
+      <Select value={value} onValueChange={(v) => onChange(v as ProjectTier)}>
+        <SelectTrigger>
+          <SelectValue />
+        </SelectTrigger>
+        <SelectContent>
+          <SelectItem value="fast">Fast</SelectItem>
+          <SelectItem value="production">Production</SelectItem>
+        </SelectContent>
+      </Select>
+      <p className="text-muted-foreground text-xs">{DETAIL[value]}</p>
+    </div>
+  );
+}

package/components/Workspaces/ProjectTiersForm.tsx

@@ -0,0 +1,33 @@
+"use client";
+
+import { SettingToggle } from "@/components/Settings/SettingToggle";
+import { useProjectsQuery, useUpdateProject } from "@/data/projects";
+
+// A workspace's projects, each switched between production (every merge gate)
+// and fast (a task's PR merges as soon as it opens).
+export function ProjectTiersForm({ workspaceId }: { workspaceId: string }) {
+  const { data: projects } = useProjectsQuery();
+  const update = useUpdateProject();
+  const mine = (projects ?? []).filter(
+    (p) => p.workspace_id === workspaceId && !p.is_uncategorized
+  );
+  if (!mine.length) return null;
+  return (
+    <div className="space-y-2">
+      {mine.map((p) => (
+        <SettingToggle
+          key={p.id}
+          title={`${p.name}: production`}
+          detail="On: CI, the independent review and scope gate its merges. Off (fast): a task's PR merges as soon as it opens."
+          checked={p.tier === "production"}
+          onChange={(on) =>
+            update.mutate({
+              projectId: p.id,
+              tier: on ? "production" : "fast",
+            })
+          }
+        />
+      ))}
+    </div>
+  );
+}

package/components/Workspaces/WorkspaceSettings.tsx

@@ -7,6 +7,7 @@ import { RulesForm } from "./RulesForm";
 import { FreshStartForm } from "./FreshStartForm";
 import { McpServersForm } from "./McpServersForm";
 import { HqFolderForm } from "./HqFolderForm";
+import { ProjectTiersForm } from "./ProjectTiersForm";
 import { StallForm } from "./StallForm";
 import { WorkspaceModelsForm } from "./WorkspaceModelsForm";
 import { AwayWindowForm } from "@/components/Away/AwayWindowForm";
@@ -49,12 +50,19 @@ export function WorkspaceSettings() {
           <WorkspaceModelsForm workspaceId={w.id} />
           <McpServersForm workspace={w} />
           <HqFolderForm workspaceId={w.id} />
+          <ProjectTiersForm workspaceId={w.id} />
           <SettingToggle
             title="Wake tasks on CI failures and reviews"
             detail="A task's agent is messaged once when a check fails on its PR's head, with the log's tail, and when someone reviews or comments on it."
             checked={w.wake_tasks_on_pr}
             onChange={(on) => update.mutate({ id: w.id, wakeTasksOnPR: on })}
           />
+          <SettingToggle
+            title="Orchestrator full access"
+            detail="Its shell and file writes aren't checked: it can push, commit, edit any repository or file on this machine, and merge a PR directly. Off: the deny list, write limits, quick-change cap and merge-only-through-the-gates apply."
+            checked={w.orch_full_access}
+            onChange={(on) => update.mutate({ id: w.id, orchFullAccess: on })}
+          />
         </section>
       ))}
       <FreshStartForm />

package/data/chat/mcpAuth.ts

@@ -0,0 +1,42 @@
+import { useMutation } from "@tanstack/react-query";
+import type { McpSignInStart } from "@/lib/chat/events";
+
+type Body = {
+  action: "start" | "submit" | "reconnect";
+  server: string;
+  itemId: string;
+  url?: string;
+};
+
+async function post<T>(sessionId: string, body: Body): Promise<T> {
+  const res = await fetch(`/api/sessions/${sessionId}/mcp-auth`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify(body),
+  });
+  const data = await res.json().catch(() => ({}));
+  if (!res.ok) throw new Error(data.error || `Request failed (${res.status})`);
+  return data as T;
+}
+
+// Sign in to one MCP server of a chat's /mcp list. The list itself updates
+// over the chat socket once the server is back.
+export function useMcpSignIn(
+  sessionId: string,
+  itemId: string,
+  server: string
+) {
+  const start = useMutation({
+    mutationFn: () =>
+      post<McpSignInStart>(sessionId, { action: "start", server, itemId }),
+  });
+  const finish = useMutation({
+    mutationFn: (url: string) =>
+      post<{ ok: true }>(sessionId, { action: "submit", server, itemId, url }),
+  });
+  const recheck = useMutation({
+    mutationFn: () =>
+      post<{ ok: true }>(sessionId, { action: "reconnect", server, itemId }),
+  });
+  return { start, finish, recheck };
+}

package/data/projects/queries.ts

@@ -3,6 +3,7 @@ import type {
   ProjectWithRepositories,
   DetectedDevServer,
 } from "@/lib/projects";
+import type { ProjectTier } from "@/lib/db/types";
 import { projectKeys } from "./keys";
 import { sessionKeys } from "../sessions/keys";
 
@@ -131,6 +132,7 @@ export function useUpdateProject() {
       agentType,
       defaultModel,
       initialPrompt,
+      tier,
     }: {
       projectId: string;
       name?: string;
@@ -138,6 +140,7 @@ export function useUpdateProject() {
       agentType?: string;
       defaultModel?: string;
       initialPrompt?: string | null;
+      tier?: ProjectTier;
     }) => {
       const res = await fetch(`/api/projects/${projectId}`, {
         method: "PATCH",
@@ -148,6 +151,7 @@ export function useUpdateProject() {
           agentType,
           defaultModel,
           initialPrompt,
+          tier,
         }),
       });
       if (!res.ok) throw new Error("Failed to update project");

package/data/workspaces/index.ts

@@ -66,6 +66,8 @@ export function useUpdateWorkspace() {
       maxRunningTasks?: number | null;
       // Message tasks about failing checks and reviews on their PRs.
       wakeTasksOnPR?: boolean;
+      // Its orchestrator runs without guards.
+      orchFullAccess?: boolean;
       // MCP servers its orchestrator may use, by name.
       mcpServers?: string[];
     }) =>
@@ -80,6 +82,7 @@ export function useUpdateWorkspace() {
       id,
       maxRunningTasks,
       wakeTasksOnPR,
+      orchFullAccess,
       mcpServers,
       ...updates
     }) => {
@@ -96,6 +99,9 @@ export function useUpdateWorkspace() {
                 ...(wakeTasksOnPR !== undefined && {
                   wake_tasks_on_pr: wakeTasksOnPR,
                 }),
+                ...(orchFullAccess !== undefined && {
+                  orch_full_access: orchFullAccess,
+                }),
                 ...(mcpServers !== undefined && {
                   orch_mcp_servers: mcpServers,
                 }),

package/lib/chat/driver.ts

@@ -11,9 +11,26 @@ import type {
   ChatModel,
   DriverEvent,
   FileSuggestion,
+  McpServerView,
+  McpSignInStart,
   UndoPreview,
 } from "./events";
 
+// An agent's way of signing in to an MCP server that needs it, without
+// restarting the conversation. Tokens stay with the agent; the host only
+// sees the link to open and, later, the address the provider returned to.
+export interface McpAuth {
+  // `state` ties the provider's return to this attempt; it stays server-side.
+  start(
+    server: string,
+    redirectUri?: string
+  ): Promise<McpSignInStart & { state?: string }>;
+  // Hands over the address the provider returned the browser to.
+  submit(server: string, callbackUrl: string): Promise<void>;
+  reconnect(server: string): Promise<void>;
+  servers(): Promise<McpServerView[]>;
+}
+
 export interface ChatStartOptions {
   cwd: string;
   model: string;
@@ -39,7 +56,8 @@ export interface ChatStartOptions {
   // can't be changed for this conversation.
   permissionMode?: PermissionMode;
   // Checked before every tool call, whatever the permissions say: why it's
-  // refused, or null to let it go on to them.
+  // refused, null to let it go on to them, or a warning the agent is shown
+  // while the call still goes on.
   toolGuard?: ToolGuard;
   // The note handed back to the agent right after its context is compacted
   // (lib/chat/compact-context), empty for none. Only Claude Code has a hook
@@ -47,10 +65,12 @@ export interface ChatStartOptions {
   compactContext?: () => Promise<string>;
 }
 
+export type ToolGuardResult = string | null | { warning: string };
+
 export type ToolGuard = (
   tool: string,
   input: Record<string, unknown>
-) => Promise<string | null>;
+) => Promise<ToolGuardResult>;
 
 // One live conversation with an agent. Messages sent while a turn runs are
 // queued by the provider and folded into the conversation.
@@ -88,6 +108,8 @@ export interface ChatConversation {
   backgroundTask?(toolUseId?: string): Promise<boolean>;
   // Puts files back as they were before a message (dryRun: only say what).
   undo(checkpoint: string, dryRun: boolean): Promise<UndoResult>;
+  // Signing in to an MCP server that needs it (Claude's).
+  mcpAuth?: McpAuth;
   close(): void;
   events: AsyncIterable<DriverEvent>;
 }

package/lib/chat/drivers/claude-approvals.ts

@@ -248,6 +248,13 @@ export function guardHook(guard: ToolGuard): HookCallback {
       (input.tool_input ?? {}) as Record<string, unknown>
     ).catch((e: Error) => `Couldn't check this call: ${e.message}`);
     if (reason === null) return {};
+    if (typeof reason !== "string")
+      return {
+        hookSpecificOutput: {
+          hookEventName: "PreToolUse",
+          additionalContext: reason.warning,
+        },
+      };
     return {
       hookSpecificOutput: {
         hookEventName: "PreToolUse",

package/lib/chat/drivers/claude-mcp-auth.ts

@@ -0,0 +1,82 @@
+import type { McpServerStatus, Query } from "@anthropic-ai/claude-agent-sdk";
+import type { McpAuth } from "../driver";
+import type { McpServerView, McpSignInStart } from "../events";
+
+// The CLI takes these as control requests and the SDK's Query has the
+// methods, but its type declarations don't list them.
+type AuthQuery = Query & {
+  mcpAuthenticate?(server: string, redirectUri?: string): Promise<unknown>;
+  mcpSubmitOAuthCallbackUrl?(server: string, url: string): Promise<unknown>;
+};
+
+const LOOPBACK = new Set(["localhost", "127.0.0.1", "[::1]"]);
+
+// Only a link a person can safely open: https, or http to this machine.
+export function safeAuthUrl(value: unknown): string | null {
+  if (typeof value !== "string") return null;
+  try {
+    const url = new URL(value);
+    if (url.protocol === "https:") return url.href;
+    if (url.protocol === "http:" && LOOPBACK.has(url.hostname)) return url.href;
+  } catch {
+    // Not a URL.
+  }
+  return null;
+}
+
+// The CLI's answer to mcp_authenticate, as what the UI needs.
+export function toSignInStart(
+  response: unknown
+): McpSignInStart & { state?: string } {
+  const r = (response ?? {}) as {
+    authUrl?: unknown;
+    requiresUserAction?: unknown;
+    callbackExpected?: unknown;
+    redirectScheme?: unknown;
+    state?: unknown;
+  };
+  if (!r.requiresUserAction && r.authUrl === undefined) return { mode: "done" };
+  const authUrl = safeAuthUrl(r.authUrl);
+  if (!authUrl)
+    throw new Error("The server gave a sign-in link AgentOS won't open");
+  if (!r.callbackExpected) return { mode: "external", authUrl };
+  const state = typeof r.state === "string" ? r.state : undefined;
+  return r.redirectScheme === "custom"
+    ? { mode: "callback", authUrl, state }
+    : { mode: "paste", authUrl, state };
+}
+
+// Whether a server can be signed in to: it speaks OAuth over HTTP.
+export function canSignIn(s: McpServerStatus): boolean {
+  if (s.status !== "needs-auth") return false;
+  const c = s.config as { type?: string; command?: unknown } | undefined;
+  if (!c) return true;
+  return c.type === "http" || c.type === "sse" || c.type === "claudeai-proxy";
+}
+
+export function claudeMcpAuth(
+  q: Query,
+  view: (s: McpServerStatus) => McpServerView
+): McpAuth {
+  const auth = q as AuthQuery;
+  return {
+    async start(server, redirectUri) {
+      if (!auth.mcpAuthenticate)
+        throw new Error(
+          "This Claude Code version can't sign in to MCP servers from AgentOS"
+        );
+      return toSignInStart(await auth.mcpAuthenticate(server, redirectUri));
+    },
+    async submit(server, callbackUrl) {
+      if (!auth.mcpSubmitOAuthCallbackUrl)
+        throw new Error(
+          "This Claude Code version can't sign in to MCP servers from AgentOS"
+        );
+      await auth.mcpSubmitOAuthCallbackUrl(server, callbackUrl);
+    },
+    reconnect: (server) => q.reconnectMcpServer(server),
+    async servers() {
+      return (await q.mcpServerStatus()).map(view);
+    },
+  };
+}

package/lib/chat/drivers/claude.ts

@@ -29,6 +29,7 @@ import { NO_ATTRIBUTION } from "../../agents/attribution";
 import { SUBAGENTS_ENV } from "../../models/subagent-env";
 import { parseSubagentEnv, subagentModelHook } from "../../models/subagents";
 import { callFromAssistant } from "../../usage/calls";
+import { canSignIn, claudeMcpAuth } from "./claude-mcp-auth";
 
 // Claude Code through the Agent SDK, signed in with the user's own Claude
 // Code login. Asks for approval through chat cards unless given full access,
@@ -71,6 +72,10 @@ function cleanError(text?: string): string | undefined {
   return line.length > 300 ? `${line.slice(0, 299)}…` : line;
 }
 
+export function cleanMcpError(text?: string): string | undefined {
+  return cleanError(text);
+}
+
 export function mcpView(s: McpServerStatus): McpServerView {
   return {
     name: s.name,
@@ -78,6 +83,7 @@ export function mcpView(s: McpServerStatus): McpServerView {
     scope: s.source ?? s.scope,
     version: s.serverInfo?.version,
     error: cleanError(s.error),
+    ...(canSignIn(s) && { signIn: true }),
     tools: (s.tools ?? []).map((t) => ({
       name: t.name,
       description: firstLine(t.description),
@@ -346,6 +352,7 @@ export const claudeDriver: ChatDriver = {
           },
         ]);
       },
+      mcpAuth: claudeMcpAuth(q, mcpView),
       async interrupt() {
         await q.interrupt();
       },

package/lib/chat/events.ts

@@ -104,9 +104,21 @@ export interface McpServerView {
   scope?: string;
   version?: string;
   error?: string;
+  // Needs sign-in and AgentOS can start it (the driver can, and the server
+  // speaks OAuth over HTTP). Decided by the server, never by its name.
+  signIn?: boolean;
   tools: { name: string; description?: string }[];
 }
 
+// What starting an MCP server's sign-in came back with: "callback" (open the
+// link; the provider returns to AgentOS), "paste" (the provider only returns
+// to the machine running the session: paste the address it ends on),
+// "external" (finish on claude.ai) or "done" (signed in without asking).
+export interface McpSignInStart {
+  mode: "callback" | "paste" | "external" | "done";
+  authUrl?: string;
+}
+
 // How full the conversation's context window is, as the agent last measured.
 export interface ChatContext {
   usedTokens: number;