@vertesia/ui 1.6.0-dev.20260918.090710Z → 1.6.0-dev.20260918.115658Z

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vertesia/ui",
-  "version": "1.6.0-dev.20260918.090710Z",
+  "version": "1.6.0-dev.20260918.115658Z",
   "description": "Vertesia UI components and and hooks",
   "type": "module",
   "main": "./lib/index.js",
@@ -45,11 +45,11 @@
     "@radix-ui/react-switch": "^1.3.7",
     "@radix-ui/react-tabs": "^1.1.21",
     "@radix-ui/react-tooltip": "^1.2.16",
-    "@vertesia/client": "1.6.0-dev.20260918.090710Z",
-    "@vertesia/common": "1.6.0-dev.20260918.090710Z",
-    "@vertesia/fusion-ux": "1.6.0-dev.20260918.090710Z",
-    "@vertesia/json": "1.6.0-dev.20260918.090710Z",
-    "@vertesia/rich-text": "1.6.0-dev.20260918.090710Z",
+    "@vertesia/client": "1.6.0-dev.20260918.115658Z",
+    "@vertesia/common": "1.6.0-dev.20260918.115658Z",
+    "@vertesia/fusion-ux": "1.6.0-dev.20260918.115658Z",
+    "@vertesia/json": "1.6.0-dev.20260918.115658Z",
+    "@vertesia/rich-text": "1.6.0-dev.20260918.115658Z",
     "ajv": "^8.20.0",
     "ajv-formats": "^3.0.1",
     "aria-hidden": "^1.2.6",
@@ -188,7 +188,7 @@
     "url": "https://github.com/vertesia/composableai.git",
     "directory": "packages/ui"
   },
-  "gitHead": "10f35da1a210e1950f9c8b1368fea89328a23ea0",
+  "gitHead": "5961811f0fdaee3b4902a2230875a3325e64ad80",
   "scripts": {
     "clean:lib": "rimraf ./lib ./tsconfig.tsbuildinfo",
     "clean": "rimraf ./node_modules ./lib ./tsconfig.tsbuildinfo",

package/src/features/oauth/McpConnectionsButton.test.tsx

@@ -183,6 +183,62 @@ describe('MCP connection controls', () => {
         expect(onChange).toHaveBeenCalledWith(['linear']);
     });
 
+    it.each([{ oauthIds: [] }, { oauthIds: ['anonymous'] }])(
+        'shows anonymous servers without status requests, including stale OAuth ids %j',
+        async ({ oauthIds }) => {
+            mocks.getInstalledApps.mockResolvedValue([
+                {
+                    id: 'anonymous-app',
+                    manifest: {
+                        name: 'anonymous-app',
+                        tool_collections: [
+                            {
+                                type: 'mcp',
+                                id: 'anonymous',
+                                name: 'Anonymous MCP',
+                                namespace: 'anonymous',
+                                url: 'https://anonymous.example.com/mcp',
+                                auth: 'none',
+                                oauth_app: 'stale-oauth-app',
+                            },
+                        ],
+                    },
+                    oauth_collection_ids: oauthIds,
+                },
+            ]);
+            const onChange = vi.fn();
+            const { rerender } = renderWithProviders(
+                <McpConnectionsInlineList disabledCollections={['other']} onChange={onChange} />,
+            );
+
+            expect(await screen.findByText('Anonymous MCP')).not.toBeNull();
+            expect(screen.getAllByText('No authentication')).toHaveLength(1);
+            expect(screen.queryByRole('button', { name: /connect/i })).toBeNull();
+            expect(mocks.getStatus).not.toHaveBeenCalled();
+            expect(mocks.getCollectionStatus).not.toHaveBeenCalled();
+
+            fireEvent.click(screen.getByRole('switch', { name: 'Deactivate Anonymous MCP for this conversation' }));
+            expect(onChange).toHaveBeenLastCalledWith(['other', 'anonymous']);
+            rerender(<McpConnectionsInlineList disabledCollections={['other', 'anonymous']} onChange={onChange} />);
+            fireEvent.click(screen.getByRole('switch', { name: 'Activate Anonymous MCP for this conversation' }));
+            expect(onChange).toHaveBeenLastCalledWith(['other']);
+            rerender(<McpConnectionsInlineList onChange={onChange} readOnly />);
+            expect(screen.getByRole('switch')).toHaveProperty('disabled', true);
+
+            rerender(<McpConnectionsActionMenu onChange={onChange} />);
+            fireEvent.pointerDown(await screen.findByRole('button', { name: /settings/i }));
+            const menuItem = await screen.findByText('MCP');
+            expect(screen.getByText('1')).not.toBeNull();
+            fireEvent.click(menuItem);
+            expect(await screen.findByText('Anonymous MCP')).not.toBeNull();
+            expect(screen.getByText('No authentication')).not.toBeNull();
+            expect(screen.queryByRole('button', { name: /connect/i })).toBeNull();
+            fireEvent.click(screen.getByRole('switch', { name: 'Deactivate Anonymous MCP for this conversation' }));
+            expect(onChange).toHaveBeenLastCalledWith(['anonymous']);
+            expect(mocks.getStatus).not.toHaveBeenCalled();
+        },
+    );
+
     it('renders MCP rows before connection statuses finish loading', async () => {
         const statusRequest =
             deferred<

package/src/features/oauth/McpConnectionsButton.tsx

@@ -7,6 +7,7 @@ import { RemoteMcpConnectionButton } from './RemoteMcpConnectionButton.js';
 import {
     countConnectedActiveGroups,
     getConnectedActiveGroupLabels,
+    isGroupConnected,
     isGroupDisabled,
     toggleGroupDisabled,
     useMcpConnections,
@@ -29,7 +30,7 @@ export interface McpConnectionsButtonProps {
 /**
  * Toolbar button that opens the MCP connections dialog. The badge shows how many MCP
  * servers are connected and active for this conversation.
- * Renders nothing when the project has no OAuth MCP servers installed.
+ * Renders nothing when the project has no MCP servers installed.
  */
 export function McpConnectionsButton({
     disabledCollections,
@@ -93,7 +94,7 @@ export function McpConnectionsButton({
 }
 
 /**
- * Inline MCP status list for forms. It shows all available authenticated MCP groups
+ * Inline MCP status list for forms. It shows all available MCP groups
  * without requiring the user to open the management dialog.
  */
 export function McpConnectionsInlineList({
@@ -127,7 +128,7 @@ export function McpConnectionsInlineList({
         <div className="space-y-1">
             {groups.map((group) => {
                 const active = !isGroupDisabled(group, disabledCollections);
-                const connected = group.authStatus?.authenticated === true;
+                const connected = isGroupConnected(group);
                 const interactiveOAuth = group.authType === 'oauth' && group.oauthGrantType !== 'client_credentials';
                 const StatusIcon = connected ? Link2 : Link2Off;
                 return (
@@ -179,9 +180,11 @@ export function McpConnectionsInlineList({
                             />
                         ) : (
                             <Badge variant="outline" className="h-6 w-32 justify-center px-2 text-xs">
-                                {group.authType === 'api_key'
-                                    ? t('mcpConnections.apiKey')
-                                    : t('mcpConnections.managedByApp')}
+                                {group.authType === 'none'
+                                    ? t('mcpConnections.noAuthentication')
+                                    : group.authType === 'api_key'
+                                      ? t('mcpConnections.apiKey')
+                                      : t('mcpConnections.managedByApp')}
                             </Badge>
                         )}
                         {onChange && (

package/src/features/oauth/McpConnectionsDialog.tsx

@@ -2,7 +2,12 @@ import { useUITranslation } from '@vertesia/ui/i18n';
 import { Link2, Link2Off } from 'lucide-react';
 import { Badge, Button, Modal, ModalBody, ModalTitle, Spinner, Switch, VTooltip } from '../../core/index.js';
 import { RemoteMcpConnectionButton } from './RemoteMcpConnectionButton.js';
-import { isGroupDisabled, type McpConnectionGroup, toggleGroupDisabled } from './useMcpConnections.js';
+import {
+    isGroupConnected,
+    isGroupDisabled,
+    type McpConnectionGroup,
+    toggleGroupDisabled,
+} from './useMcpConnections.js';
 
 export interface McpConnectionsDialogProps {
     isOpen: boolean;
@@ -61,7 +66,7 @@ export function McpConnectionsDialog({
                     <div className="space-y-1">
                         {groups.map((group) => {
                             const active = !isGroupDisabled(group, disabledCollections);
-                            const connected = group.authStatus?.authenticated === true;
+                            const connected = isGroupConnected(group);
                             const interactiveOAuth =
                                 group.authType === 'oauth' && group.oauthGrantType !== 'client_credentials';
                             const StatusIcon = connected ? Link2 : Link2Off;
@@ -115,11 +120,15 @@ export function McpConnectionsDialog({
                                                 showDisconnect
                                                 readOnly={readOnly}
                                             />
-                                        ) : group.authType === 'oauth' ? (
+                                        ) : (
                                             <Badge variant="outline" className="h-6 w-32 justify-center px-2 text-xs">
-                                                {t('mcpConnections.managedByApp')}
+                                                {group.authType === 'none'
+                                                    ? t('mcpConnections.noAuthentication')
+                                                    : group.authType === 'api_key'
+                                                      ? t('mcpConnections.apiKey')
+                                                      : t('mcpConnections.managedByApp')}
                                             </Badge>
-                                        ) : null}
+                                        )}
                                         {onChange && (
                                             <Switch
                                                 size="sm"

package/src/features/oauth/useMcpConnections.test.ts

@@ -93,3 +93,13 @@ describe('toggleGroupDisabled', () => {
         expect(toggleGroupDisabled(g, disabled, true)).toEqual([]);
     });
 });
+
+describe('anonymous MCP groups', () => {
+    it('counts anonymous servers without credential status and respects disabled collections', () => {
+        const anonymous = { ...group(['anonymous'], false, 'Anonymous'), authType: 'none' as const };
+        expect(countConnectedActiveGroups([anonymous])).toBe(1);
+        expect(getConnectedActiveGroupLabels([anonymous])).toEqual(['Anonymous']);
+        expect(countConnectedActiveGroups([anonymous], ['anonymous'])).toBe(0);
+        expect(getConnectedActiveGroupLabels([anonymous], ['anonymous'])).toEqual([]);
+    });
+});

package/src/features/oauth/useMcpConnections.ts

@@ -20,13 +20,13 @@ export interface McpConnectionGroup {
     memberIds: string[];
     /** Collection names represented by this row. */
     memberNames: string[];
-    authType: 'oauth' | 'api_key';
+    authType: 'none' | 'oauth' | 'api_key';
     oauthGrantType?: 'authorization_code' | 'client_credentials';
     authStatus?: OAuthAuthStatus;
 }
 
 /**
- * Loads the project's installed authenticated MCP tool collections and resolves their status.
+ * Loads the project's installed MCP tool collections and resolves their status.
  *
  * Shared by the MCP connections button (badge count) and dialog (list) so the data is
  * fetched once and refreshed together after connect/disconnect.
@@ -57,8 +57,10 @@ export function useMcpConnections() {
                 const mcpCollections = inst.manifest.tool_collections
                     .map((c) => normalizeToolCollection(c))
                     .filter((c): c is MCPToolCollectionObject => c.type === 'mcp');
-                const oauthCollections = mcpCollections.filter((c) => c.auth !== 'api_key' && oauthIds.includes(c.id));
-                const apiKeyCollections = mcpCollections.filter((c) => c.auth === 'api_key');
+                const oauthCollections = mcpCollections.filter(
+                    (c) => c.auth !== 'none' && c.auth !== 'api_key' && oauthIds.includes(c.id),
+                );
+                const directCollections = mcpCollections.filter((c) => c.auth === 'none' || c.auth === 'api_key');
 
                 const providerMap = new Map<string, MCPToolCollectionObject[]>();
                 const oauthAppMap = new Map<string, MCPToolCollectionObject[]>();
@@ -124,16 +126,16 @@ export function useMcpConnections() {
                     });
                 }
 
-                for (const col of apiKeyCollections) {
+                for (const col of directCollections) {
                     allGroups.push({
-                        key: `${inst.id}:api-key:${col.id}`,
+                        key: `${inst.id}:${col.auth}:${col.id}`,
                         appId: inst.id,
                         appName: inst.manifest.title || inst.manifest.name,
                         label: col.name,
                         representativeId: col.id,
                         memberIds: [col.id],
                         memberNames: [col.name],
-                        authType: 'api_key',
+                        authType: col.auth === 'none' ? 'none' : 'api_key',
                     });
                 }
             }
@@ -155,6 +157,8 @@ export function useMcpConnections() {
             const statusRequestsByApp = new Map<string, Promise<OAuthAuthStatus[]>>();
             const groupsWithStatus = await Promise.all(
                 allGroups.map(async (group) => {
+                    // Anonymous servers are available without a credential status lookup.
+                    if (group.authType === 'none') return group;
                     try {
                         let statusRequest = statusRequestsByApp.get(group.appId);
                         if (!statusRequest) {
@@ -219,15 +223,19 @@ export function toggleGroupDisabled(
     return Array.from(current);
 }
 
+/** Anonymous servers are available without authentication; other modes require valid credentials. */
+export function isGroupConnected(group: McpConnectionGroup): boolean {
+    return group.authType === 'none' || group.authStatus?.authenticated === true;
+}
+
 /** Count connected MCP groups that are enabled for the current conversation. */
 export function countConnectedActiveGroups(groups: McpConnectionGroup[], disabled?: string[]): number {
-    return groups.filter((group) => group.authStatus?.authenticated === true && !isGroupDisabled(group, disabled))
-        .length;
+    return groups.filter((group) => isGroupConnected(group) && !isGroupDisabled(group, disabled)).length;
 }
 
 /** Names of connected MCP groups that are enabled for the current conversation. */
 export function getConnectedActiveGroupLabels(groups: McpConnectionGroup[], disabled?: string[]): string[] {
     return groups
-        .filter((group) => group.authStatus?.authenticated === true && !isGroupDisabled(group, disabled))
+        .filter((group) => isGroupConnected(group) && !isGroupDisabled(group, disabled))
         .map((group) => group.label);
 }

package/src/i18n/locales/ar.json

@@ -407,6 +407,7 @@
     "mcpConnections.label": "MCP",
     "mcpConnections.manage": "إدارة اتصالات MCP",
     "mcpConnections.managedByApp": "يُدار بواسطة التطبيق",
+    "mcpConnections.noAuthentication": "بدون مصادقة",
     "mcpConnections.settings": "الإعدادات",
     "mcpConnections.subtitle": "إدارة خوادم MCP المتاحة لهذه المحادثة.",
     "mcpConnections.title": "MCP",

package/src/i18n/locales/de.json

@@ -395,6 +395,7 @@
     "mcpConnections.label": "MCP",
     "mcpConnections.manage": "MCP-Verbindungen verwalten",
     "mcpConnections.managedByApp": "Von der App verwaltet",
+    "mcpConnections.noAuthentication": "Keine Authentifizierung",
     "mcpConnections.settings": "Einstellungen",
     "mcpConnections.subtitle": "Verwalten Sie die für diese Unterhaltung verfügbaren MCP-Server.",
     "mcpConnections.title": "MCP",

package/src/i18n/locales/en.json

@@ -705,6 +705,7 @@
     "mcpConnections.label": "MCP",
     "mcpConnections.manage": "Manage MCP connections",
     "mcpConnections.managedByApp": "Managed by app",
+    "mcpConnections.noAuthentication": "No authentication",
     "mcpConnections.settings": "Settings",
     "mcpConnections.subtitle": "Manage the MCP servers available to this conversation.",
     "mcpConnections.title": "MCP",

package/src/i18n/locales/es.json

@@ -397,6 +397,7 @@
     "mcpConnections.label": "MCP",
     "mcpConnections.manage": "Gestionar conexiones MCP",
     "mcpConnections.managedByApp": "Gestionado por la aplicación",
+    "mcpConnections.noAuthentication": "Sin autenticación",
     "mcpConnections.settings": "Configuración",
     "mcpConnections.subtitle": "Gestiona los servidores MCP disponibles para esta conversación.",
     "mcpConnections.title": "MCP",

package/src/i18n/locales/fr.json

@@ -397,6 +397,7 @@
     "mcpConnections.label": "MCP",
     "mcpConnections.manage": "Gérer les connexions MCP",
     "mcpConnections.managedByApp": "Géré par l’application",
+    "mcpConnections.noAuthentication": "Sans authentification",
     "mcpConnections.settings": "Paramètres",
     "mcpConnections.subtitle": "Gérez les serveurs MCP disponibles pour cette conversation.",
     "mcpConnections.title": "MCP",

package/src/i18n/locales/it.json

@@ -397,6 +397,7 @@
     "mcpConnections.label": "MCP",
     "mcpConnections.manage": "Gestisci connessioni MCP",
     "mcpConnections.managedByApp": "Gestito dall'app",
+    "mcpConnections.noAuthentication": "Nessuna autenticazione",
     "mcpConnections.settings": "Impostazioni",
     "mcpConnections.subtitle": "Gestisci i server MCP disponibili per questa conversazione.",
     "mcpConnections.title": "MCP",

package/src/i18n/locales/ja.json

@@ -395,6 +395,7 @@
     "mcpConnections.label": "MCP",
     "mcpConnections.manage": "MCP 接続を管理",
     "mcpConnections.managedByApp": "アプリによる管理",
+    "mcpConnections.noAuthentication": "認証なし",
     "mcpConnections.settings": "設定",
     "mcpConnections.subtitle": "この会話で利用できる MCP サーバーを管理します。",
     "mcpConnections.title": "MCP",

package/src/i18n/locales/ko.json

@@ -395,6 +395,7 @@
     "mcpConnections.label": "MCP",
     "mcpConnections.manage": "MCP 연결 관리",
     "mcpConnections.managedByApp": "앱에서 관리",
+    "mcpConnections.noAuthentication": "인증 없음",
     "mcpConnections.settings": "설정",
     "mcpConnections.subtitle": "이 대화에서 사용할 수 있는 MCP 서버를 관리합니다.",
     "mcpConnections.title": "MCP",

package/src/i18n/locales/pt.json

@@ -397,6 +397,7 @@
     "mcpConnections.label": "MCP",
     "mcpConnections.manage": "Gerenciar conexões MCP",
     "mcpConnections.managedByApp": "Gerenciado pelo aplicativo",
+    "mcpConnections.noAuthentication": "Sem autenticação",
     "mcpConnections.settings": "Configurações",
     "mcpConnections.subtitle": "Gerencie os servidores MCP disponíveis para esta conversa.",
     "mcpConnections.title": "MCP",

package/src/i18n/locales/ru.json

@@ -401,6 +401,7 @@
     "mcpConnections.label": "MCP",
     "mcpConnections.manage": "Управление подключениями MCP",
     "mcpConnections.managedByApp": "Управляется приложением",
+    "mcpConnections.noAuthentication": "Без аутентификации",
     "mcpConnections.settings": "Настройки",
     "mcpConnections.subtitle": "Управляйте серверами MCP, доступными для этого разговора.",
     "mcpConnections.title": "MCP",

package/src/i18n/locales/tr.json

@@ -395,6 +395,7 @@
     "mcpConnections.label": "MCP",
     "mcpConnections.manage": "MCP bağlantılarını yönet",
     "mcpConnections.managedByApp": "Uygulama tarafından yönetiliyor",
+    "mcpConnections.noAuthentication": "Kimlik doğrulama yok",
     "mcpConnections.settings": "Ayarlar",
     "mcpConnections.subtitle": "Bu konuşma için kullanılabilen MCP sunucularını yönetin.",
     "mcpConnections.title": "MCP",

package/src/i18n/locales/zh-TW.json

@@ -395,6 +395,7 @@
     "mcpConnections.label": "MCP",
     "mcpConnections.manage": "管理 MCP 連線",
     "mcpConnections.managedByApp": "由應用程式管理",
+    "mcpConnections.noAuthentication": "無需驗證",
     "mcpConnections.settings": "設定",
     "mcpConnections.subtitle": "管理可用於此對話的 MCP 伺服器。",
     "mcpConnections.title": "MCP",

package/src/i18n/locales/zh.json

@@ -395,6 +395,7 @@
     "mcpConnections.label": "MCP",
     "mcpConnections.manage": "管理 MCP 连接",
     "mcpConnections.managedByApp": "由应用管理",
+    "mcpConnections.noAuthentication": "无需身份验证",
     "mcpConnections.settings": "设置",
     "mcpConnections.subtitle": "管理可用于此对话的 MCP 服务器。",
     "mcpConnections.title": "MCP",

package/src/session/auth/oauth.test.ts

@@ -90,6 +90,7 @@ it('uses CIMD and PKCE, exchanges the callback once and restores the app deep li
     await vi.waitFor(() => expect(replace).toHaveBeenCalledTimes(1));
     const authorize = new URL(replace.mock.calls[0][0]);
     expect(authorize.searchParams.get('client_id')).toBe(clientId);
+    expect(authorize.searchParams.get('resource')).toBe(`${issuer}/`);
     expect(authorize.searchParams.get('redirect_uri')).toBe(`${origin}/app`);
     expect(authorize.searchParams.get('scope')).toBe('openid profile content:read');
     expect(authorize.searchParams.get('project_id')).toBe('p');
@@ -106,6 +107,7 @@ it('uses CIMD and PKCE, exchanges the callback once and restores the app deep li
     const body = exchange.init?.body as URLSearchParams;
     expect(body.get('code_verifier')).toBe(txn.verifier);
     expect(body.get('grant_type')).toBe('authorization_code');
+    expect(body.get('resource')).toBe(authorize.searchParams.get('resource'));
     expect(body.has('client_secret')).toBe(false);
     expect(storage.has('vertesia.oauth.transaction')).toBe(false);
     expect(browser.location.href).toBe(`${origin}/app/report?a=a&p=p#chart`);

package/src/session/auth/oauth.ts

@@ -104,12 +104,14 @@ async function acquireToken(): Promise<string> {
     if (metadata.issuer.replace(/\/+$/, '') !== issuer) throw new Error('OAuth issuer mismatch');
     const authorize = httpsUrl(metadata.authorization_endpoint);
     const tokenEndpoint = httpsUrl(metadata.token_endpoint);
+    const resource = new URL(metadata.issuer).toString();
     if (transaction && code) {
         const response = await fetch(tokenEndpoint, {
             method: 'POST',
             headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
             body: new URLSearchParams({
                 grant_type: 'authorization_code',
+                resource,
                 code,
                 client_id: clientId,
                 redirect_uri: redirectUri,
@@ -156,6 +158,7 @@ async function acquireToken(): Promise<string> {
     authorize.searchParams.set('client_id', clientId);
     authorize.searchParams.set('redirect_uri', redirectUri);
     authorize.searchParams.set('response_type', 'code');
+    authorize.searchParams.set('resource', resource);
     authorize.searchParams.set('state', next.state);
     authorize.searchParams.set('code_challenge_method', 'S256');
     authorize.searchParams.set('code_challenge', base64url(new Uint8Array(digest)));