@tencent-ai/agent-harness 0.2.0-beta.6 → 0.2.0-beta.8

package/executor/lib/capsule/manifest.json

@@ -28,9 +28,9 @@
   "bundledDependencyVersions": {
     "@executor-js/plugin-mcp": "1.6.10",
     "@executor-js/sdk": "1.6.10",
-    "@effect/platform-node": "4.0.0-rc.118"
+    "@effect/platform-node": "4.0.0"
   },
   "sharedDependencyVersions": {
-    "effect": "4.0.0-rc.118"
+    "effect": "4.0.0"
   }
 }

package/executor/lib/private-protocol.cjs

@@ -300,6 +300,27 @@ function isExecutorPrivateRequest(value) {
     }
     const params = value.params;
     switch (value.method) {
+        case 'oauth/start':
+            return hasExactKeys(params, ['registrationId', 'input'])
+                && isNonEmptyString(params.registrationId)
+                && isRecord(params.input)
+                && hasExactKeys(params.input, ['redirectUri'], ['client'])
+                && isNonEmptyString(params.input.redirectUri)
+                && (params.input.client === undefined || (isRecord(params.input.client)
+                    && hasExactKeys(params.input.client, ['clientId'], ['clientSecret'])
+                    && isNonEmptyString(params.input.client.clientId)
+                    && (params.input.client.clientSecret === undefined || typeof params.input.client.clientSecret === 'string')));
+        case 'oauth/complete':
+            return hasExactKeys(params, ['registrationId', 'state', 'code'])
+                && isNonEmptyString(params.registrationId)
+                && isNonEmptyString(params.state)
+                && isNonEmptyString(params.code);
+        case 'oauth/cancel':
+            return hasExactKeys(params, ['registrationId'], ['state'])
+                && isNonEmptyString(params.registrationId)
+                && (params.state === undefined || isNonEmptyString(params.state));
+        case 'oauth/logout':
+            return hasExactKeys(params, ['registrationId']) && isNonEmptyString(params.registrationId);
         case 'runtime/close':
         case 'runtime/health':
             return isEmptyRecord(params);
@@ -369,13 +390,15 @@ function isRegistrationSnapshot(value) {
             'runtimeEpoch',
             'status',
             'tools',
-        ], ['error'])
+        ], ['error', 'authStatus'])
         || !Number.isSafeInteger(value.generation)
         || value.generation < 0
         || !isNonEmptyString(value.registrationId)
         || !isNonEmptyString(value.runtimeEpoch)
         || (value.status !== 'available' && value.status !== 'unavailable')
-        || !Array.isArray(value.tools)) {
+        || !Array.isArray(value.tools)
+        || (value.authStatus !== undefined && (typeof value.authStatus !== 'string'
+            || !['unknown', 'unsupported', 'notLoggedIn', 'bearerToken', 'oAuth'].includes(value.authStatus)))) {
         return false;
     }
     if (value.error !== undefined
@@ -410,6 +433,14 @@ function isRegistrationSnapshot(value) {
 }
 function isExecutorPrivateResult(method, value) {
     switch (method) {
+        case 'oauth/start':
+            return isRecord(value) && hasExactKeys(value, ['authorizationUrl', 'state'])
+                && isNonEmptyString(value.authorizationUrl) && isNonEmptyString(value.state);
+        case 'oauth/complete':
+        case 'oauth/logout':
+            return isRegistrationSnapshot(value);
+        case 'oauth/cancel':
+            return isEmptyRecord(value);
         case 'runtime/close':
         case 'registration/remove':
         case 'tool/cancel':

package/executor/lib/private-protocol.d.cts

@@ -1,5 +1,5 @@
 import { type HarnessTraceCarrier } from './trace-context.cjs';
-import type { ExecutorElicitationRequest, ExecutorElicitationResponse, ExecutorMcpCallResult, ExecutorRegistrationSnapshot, ExecutorRegistrationSpec } from './types.cjs';
+import type { ExecutorElicitationRequest, ExecutorElicitationResponse, ExecutorMcpCallResult, ExecutorOAuthLoginInput, ExecutorOAuthLoginResult, ExecutorRegistrationSnapshot, ExecutorRegistrationSpec } from './types.cjs';
 export declare const EXECUTOR_PRIVATE_PROTOCOL_VERSION = 2;
 export declare const EXECUTOR_PRIVATE_MAX_MESSAGE_BYTES: number;
 export declare const EXECUTOR_PRIVATE_MAX_TOOL_META_BYTES: number;
@@ -75,6 +75,22 @@ export interface ExecutorPrivateProxyPolicy {
     readonly revision: string;
 }
 export interface ExecutorPrivateRequestParamsByMethod {
+    'oauth/start': {
+        readonly registrationId: string;
+        readonly input: ExecutorOAuthLoginInput;
+    };
+    'oauth/complete': {
+        readonly registrationId: string;
+        readonly state: string;
+        readonly code: string;
+    };
+    'oauth/cancel': {
+        readonly registrationId: string;
+        readonly state?: string;
+    };
+    'oauth/logout': {
+        readonly registrationId: string;
+    };
     'registration/refresh': {
         readonly registrationId: string;
     };
@@ -110,6 +126,10 @@ export interface ExecutorPrivateRequestParamsByMethod {
     };
 }
 export interface ExecutorPrivateResultByMethod {
+    'oauth/start': ExecutorOAuthLoginResult;
+    'oauth/complete': ExecutorRegistrationSnapshot;
+    'oauth/cancel': Readonly<Record<string, never>>;
+    'oauth/logout': ExecutorRegistrationSnapshot;
     'registration/refresh': ExecutorRegistrationSnapshot;
     'registration/remove': Readonly<Record<string, never>>;
     'registration/upsert': ExecutorRegistrationSnapshot;

package/executor/lib/types.d.cts

@@ -63,6 +63,7 @@ export interface ExecutorToolBinding {
     readonly upstreamToolName: string;
 }
 export interface ExecutorRegistrationSnapshot {
+    readonly authStatus?: ExecutorMcpAuthStatus;
     readonly error?: {
         readonly code: string;
         readonly message: string;
@@ -74,6 +75,20 @@ export interface ExecutorRegistrationSnapshot {
     readonly status: 'available' | 'unavailable';
     readonly tools: readonly ExecutorToolBinding[];
 }
+export type ExecutorMcpAuthStatus = 'unknown' | 'unsupported' | 'notLoggedIn' | 'bearerToken' | 'oAuth';
+/** Host owns the callback endpoint; Executor owns PKCE, grants and refresh. */
+export interface ExecutorOAuthLoginInput {
+    readonly redirectUri: string;
+    /** Omit to use the authorization server's dynamic client registration. */
+    readonly client?: {
+        readonly clientId: string;
+        readonly clientSecret?: string;
+    };
+}
+export interface ExecutorOAuthLoginResult {
+    readonly authorizationUrl: string;
+    readonly state: string;
+}
 export interface ExecutorMcpCallResult {
     readonly _meta?: Readonly<Record<string, unknown>>;
     readonly content: readonly unknown[];

package/lib/agent/v2.d.ts

@@ -153,7 +153,7 @@ export interface AgentV2ProductGenerationRotationOptions {
      */
     readonly signal?: AbortSignal;
 }
-export interface AgentV2Facade extends McpServerProtocolBackend, SubagentProtocolBackend {
+export interface AgentV2Facade extends Required<McpServerProtocolBackend>, SubagentProtocolBackend {
     readonly capabilities: AgentHarnessServerCapabilities;
     readonly initialize: AgentHarnessInitializeHandler;
     readonly notificationHandlers: ReadonlyMap<string, AgentHarnessNotificationHandler>;