doer-agent 0.9.5 → 0.9.6

package/dist/agent-codex-app-rpc.js

@@ -65,7 +65,25 @@ function normalizeCodexAppRpcRequest(args) {
     const timeoutMs = typeof args.request.timeoutMs === "number" && Number.isFinite(args.request.timeoutMs)
         ? Math.min(180_000, Math.max(1_000, Math.trunc(args.request.timeoutMs)))
         : undefined;
-    if (!requestId || !requestAgentId || requestAgentId !== args.agentId || actionRaw !== "request" || !method) {
+    if (!requestId || !requestAgentId || requestAgentId !== args.agentId) {
+        throw new Error("invalid codex app rpc request");
+    }
+    if (actionRaw === "mcp-oauth-callback") {
+        const path = typeof args.request.path === "string" ? args.request.path.trim() : "";
+        const search = typeof args.request.search === "string" ? args.request.search.trim() : "";
+        if (!path.startsWith("/") || search.length > 16_384) {
+            throw new Error("invalid MCP OAuth callback request");
+        }
+        return { requestId, action: "mcp-oauth-callback", path, search };
+    }
+    if (actionRaw === "mcp-oauth-logout") {
+        const name = typeof args.request.name === "string" ? args.request.name.trim() : "";
+        if (!/^[A-Za-z0-9_-]+$/.test(name)) {
+            throw new Error("invalid MCP OAuth logout request");
+        }
+        return { requestId, action: "mcp-oauth-logout", name };
+    }
+    if (actionRaw !== "request" || !method) {
         throw new Error("invalid codex app rpc request");
     }
     return {
@@ -82,7 +100,11 @@ async function handleCodexAppRpcMessage(args) {
         const payload = JSON.parse(codexAppRpcCodec.decode(args.msg.data));
         const request = normalizeCodexAppRpcRequest({ request: payload, agentId: args.agentId });
         requestId = request.requestId;
-        const result = applyCodexAppRpcOmitRules(request.method, await args.manager.request(request.method, request.params, request.timeoutMs));
+        const result = request.action === "request"
+            ? applyCodexAppRpcOmitRules(request.method, await args.manager.request(request.method, request.params, request.timeoutMs))
+            : request.action === "mcp-oauth-callback"
+                ? await args.manager.relayMcpOauthCallback(request.path, request.search)
+                : await args.manager.logoutMcpServer(request.name);
         args.msg.respond(codexAppRpcCodec.encode(JSON.stringify({
             requestId,
             ok: true,

package/dist/agent-codex-cli.js

@@ -41,6 +41,9 @@ function buildRemoteMcpServerConfigArgs(args) {
         "--config",
         `${prefix}.enabled=${args.enabled === false ? "false" : "true"}`,
     ];
+    if (args.auth) {
+        configArgs.push("--config", `${prefix}.auth=${toTomlStringLiteral(args.auth)}`);
+    }
     if (args.bearerTokenEnvVar?.trim()) {
         configArgs.push("--config", `${prefix}.bearer_token_env_var=${toTomlStringLiteral(args.bearerTokenEnvVar.trim())}`);
     }
@@ -50,6 +53,12 @@ function buildRemoteMcpServerConfigArgs(args) {
     if (Object.keys(args.envHttpHeaders ?? {}).length > 0) {
         configArgs.push("--config", `${prefix}.env_http_headers=${toTomlStringMap(args.envHttpHeaders ?? {})}`);
     }
+    if ((args.scopes ?? []).length > 0) {
+        configArgs.push("--config", `${prefix}.scopes=${toTomlStringArray(args.scopes ?? [])}`);
+    }
+    if (args.oauthResource?.trim()) {
+        configArgs.push("--config", `${prefix}.oauth_resource=${toTomlStringLiteral(args.oauthResource.trim())}`);
+    }
     return configArgs;
 }
 function hasDirectCodexBinary() {
@@ -157,7 +166,10 @@ export function buildCustomMcpConfigArgs(servers) {
             configArgs.push(...buildRemoteMcpServerConfigArgs({
                 serverName,
                 url: server.url,
+                auth: server.auth,
                 bearerTokenEnvVar: server.bearerTokenEnvVar,
+                scopes: server.scopes,
+                oauthResource: server.oauthResource,
                 httpHeaders: Object.fromEntries(server.httpHeaders.map((header) => [header.key, header.value])),
                 envHttpHeaders: Object.fromEntries(server.envHttpHeaders.map((header) => [header.key, header.value])),
                 enabled: true,

package/dist/agent-codex-cli.test.js

@@ -9,7 +9,10 @@ test("buildCustomMcpConfigArgs builds streamable HTTP MCP overrides", () => {
             args: [],
             env: [],
             url: "https://example.com/mcp",
+            auth: "oauth",
             bearerTokenEnvVar: "MCP_TOKEN",
+            scopes: ["read:docs"],
+            oauthResource: "https://example.com/",
             httpHeaders: [{ key: "X-Region", value: "seoul" }],
             envHttpHeaders: [{ key: "X-API-Key", value: "MCP_API_KEY" }],
             enabled: true,
@@ -17,9 +20,12 @@ test("buildCustomMcpConfigArgs builds streamable HTTP MCP overrides", () => {
     assert.deepEqual(args, [
         "--config", 'mcp_servers.remote_docs.url="https://example.com/mcp"',
         "--config", "mcp_servers.remote_docs.enabled=true",
+        "--config", 'mcp_servers.remote_docs.auth="oauth"',
         "--config", 'mcp_servers.remote_docs.bearer_token_env_var="MCP_TOKEN"',
         "--config", 'mcp_servers.remote_docs.http_headers={ "X-Region" = "seoul" }',
         "--config", 'mcp_servers.remote_docs.env_http_headers={ "X-API-Key" = "MCP_API_KEY" }',
+        "--config", 'mcp_servers.remote_docs.scopes=["read:docs"]',
+        "--config", 'mcp_servers.remote_docs.oauth_resource="https://example.com/"',
     ]);
 });
 test("buildCustomMcpConfigArgs keeps stdio MCP overrides", () => {
@@ -30,7 +36,10 @@ test("buildCustomMcpConfigArgs keeps stdio MCP overrides", () => {
             args: ["-y", "local-mcp"],
             env: [{ key: "LOCAL_TOKEN", value: "secret" }],
             url: "",
+            auth: "oauth",
             bearerTokenEnvVar: "",
+            scopes: [],
+            oauthResource: "",
             httpHeaders: [],
             envHttpHeaders: [],
             enabled: true,

package/dist/agent-settings.js

@@ -237,7 +237,10 @@ function normalizeAgentMcpServer(value) {
         args: normalizeStringArray(raw.args),
         env,
         url,
+        auth: raw.auth === "chatgpt" ? "chatgpt" : "oauth",
         bearerTokenEnvVar: typeof raw.bearerTokenEnvVar === "string" ? raw.bearerTokenEnvVar.trim() : "",
+        scopes: normalizeStringArray(raw.scopes),
+        oauthResource: typeof raw.oauthResource === "string" ? raw.oauthResource.trim() : "",
         httpHeaders: normalizeMcpHeaderEntries(raw.httpHeaders),
         envHttpHeaders: normalizeMcpHeaderEntries(raw.envHttpHeaders),
         enabled: raw.enabled !== false,
@@ -423,7 +426,10 @@ export async function toAgentSettingsPublic(args) {
                     value: variable.value,
                 })),
                 url: server.url,
+                auth: server.auth,
                 bearerTokenEnvVar: server.bearerTokenEnvVar,
+                scopes: [...server.scopes],
+                oauthResource: server.oauthResource,
                 httpHeaders: server.httpHeaders.map((header) => ({ ...header })),
                 envHttpHeaders: server.envHttpHeaders.map((header) => ({ ...header })),
                 enabled: server.enabled,

package/dist/codex-app-server-manager.js

@@ -1,7 +1,8 @@
 import { buildAgentSettingsEnvPatch, readAgentModelInstructions, resolveAgentModelInstructionsFilePath, } from "./agent-settings.js";
-import { buildCustomMcpConfigArgs, buildDaemonMcpConfigArgs, buildMobileMcpConfigArgs, buildThreadsMcpConfigArgs } from "./agent-codex-cli.js";
+import { buildCustomMcpConfigArgs, buildDaemonMcpConfigArgs, buildMobileMcpConfigArgs, buildThreadsMcpConfigArgs, spawnManagedCodexCommand, } from "./agent-codex-cli.js";
 import { CodexAppServerClient } from "./codex-app-server-client.js";
 import { startCodexChatBridge } from "./codex-chat-bridge.js";
+import { allocateMcpOauthCallbackPort, buildMcpOauthCallbackBaseUrl, relayMcpOauthCallbackToLocalListener, } from "./mcp-oauth-relay.js";
 function toTomlStringLiteral(value) {
     return `"${value.replace(/\\/g, "\\\\").replace(/"/g, '\\"')}"`;
 }
@@ -59,6 +60,8 @@ async function buildCodexAppServerArgs(args) {
         ...buildConfigArg("personality", toTomlStringLiteral(args.settings.general.personality)),
         ...buildConfigArg("approval_policy", toTomlStringLiteral("never")),
         ...buildConfigArg("sandbox_mode", toTomlStringLiteral("danger-full-access")),
+        ...buildConfigArg("mcp_oauth_callback_port", String(args.mcpOauthCallbackPort)),
+        ...buildConfigArg("mcp_oauth_callback_url", toTomlStringLiteral(args.mcpOauthCallbackUrl)),
     ];
     const customInstructions = await readAgentModelInstructions(args.workspaceRoot);
     if (customInstructions) {
@@ -140,18 +143,34 @@ export function createCodexAppServerManager(args) {
     let client = null;
     let providerProxy = null;
     let createPromise = null;
+    let mcpOauthCallbackPortPromise = null;
     let generation = 0;
     const notificationListeners = new Set();
+    const mcpOauthCallbackUrl = buildMcpOauthCallbackBaseUrl({
+        serverBaseUrl: args.serverBaseUrl,
+        userId: args.userId,
+        agentId: args.agentId,
+    });
+    const mcpOauthCallbackPathPrefix = new URL(mcpOauthCallbackUrl).pathname;
+    const resolveMcpOauthCallbackPort = async () => {
+        if (!mcpOauthCallbackPortPromise) {
+            mcpOauthCallbackPortPromise = allocateMcpOauthCallbackPort();
+        }
+        return await mcpOauthCallbackPortPromise;
+    };
     const createClient = async () => {
         const settings = await args.readAgentSettingsConfig({ workspaceRoot: args.workspaceRoot });
         const resolved = await resolveAppServerSettings({ settings, onLog: args.onLog });
         providerProxy = resolved.proxy;
+        const mcpOauthCallbackPort = await resolveMcpOauthCallbackPort();
         const appServerArgs = await buildCodexAppServerArgs({
             agentId: args.agentId,
             agentToken: args.agentToken,
             workspaceRoot: args.workspaceRoot,
             agentProjectDir: args.agentProjectDir,
             serverBaseUrl: args.serverBaseUrl,
+            mcpOauthCallbackPort,
+            mcpOauthCallbackUrl,
             settings: resolved.settings,
             userId: args.userId,
         });
@@ -164,7 +183,7 @@ export function createCodexAppServerManager(args) {
             settings: resolved.settings,
             userId: args.userId,
         });
-        args.onLog?.(`starting codex app-server model=${resolveCodexModel(resolved.settings)} reasoningEffort=${resolved.settings.codex.reasoningEffort} personality=${resolved.settings.general.personality} computerUse=${resolved.settings.codex.computerUseEnabled} browserUse=${resolved.settings.codex.browserUseEnabled} mcpServers=${resolved.settings.mcp.servers.filter((server) => server.enabled).length}`);
+        args.onLog?.(`starting codex app-server model=${resolveCodexModel(resolved.settings)} reasoningEffort=${resolved.settings.codex.reasoningEffort} personality=${resolved.settings.general.personality} computerUse=${resolved.settings.codex.computerUseEnabled} browserUse=${resolved.settings.codex.browserUseEnabled} mcpServers=${resolved.settings.mcp.servers.filter((server) => server.enabled).length} mcpOauthCallbackPort=${mcpOauthCallbackPort}`);
         return new CodexAppServerClient({
             cwd: args.workspaceRoot,
             args: appServerArgs,
@@ -202,6 +221,61 @@ export function createCodexAppServerManager(args) {
             }
         }
     };
+    const restartClient = async (reason) => {
+        generation += 1;
+        const activeClient = client;
+        const activeProxy = providerProxy;
+        client = null;
+        providerProxy = null;
+        createPromise = null;
+        if (!activeClient) {
+            args.onLog?.(`codex app-server restart requested before start reason=${reason}`);
+            return;
+        }
+        args.onLog?.(`restarting codex app-server reason=${reason}`);
+        await activeClient.stop();
+        await activeProxy?.stop().catch((error) => {
+            args.onLog?.(`failed to stop provider proxy: ${error instanceof Error ? error.message : String(error)}`);
+        });
+    };
+    const runMcpLogout = async (name) => {
+        const settings = await args.readAgentSettingsConfig({ workspaceRoot: args.workspaceRoot });
+        const server = settings.mcp.servers.find((candidate) => candidate.name === name && candidate.transport === "streamable_http");
+        if (!server) {
+            throw new Error("Remote MCP server not found");
+        }
+        const env = await buildCodexAppServerEnv({
+            agentId: args.agentId,
+            agentToken: args.agentToken,
+            workspaceRoot: args.workspaceRoot,
+            serverBaseUrl: args.serverBaseUrl,
+            resolveCodexHomePath: args.resolveCodexHomePath,
+            settings,
+            userId: args.userId,
+        });
+        const child = spawnManagedCodexCommand({
+            codexArgs: ["mcp", "logout", name, ...buildCustomMcpConfigArgs([server])],
+            taskWorkspace: args.workspaceRoot,
+            env,
+            agentToken: args.agentToken,
+        });
+        let stdout = "";
+        let stderr = "";
+        child.stdout?.on("data", (chunk) => {
+            stdout = `${stdout}${chunk}`.slice(-16_384);
+        });
+        child.stderr?.on("data", (chunk) => {
+            stderr = `${stderr}${chunk}`.slice(-16_384);
+        });
+        const exitCode = await new Promise((resolve, reject) => {
+            child.once("error", reject);
+            child.once("exit", resolve);
+        });
+        if (exitCode !== 0) {
+            throw new Error(stderr.trim() || stdout.trim() || `MCP OAuth logout failed with exit code ${exitCode ?? "unknown"}`);
+        }
+        await restartClient(`mcp oauth logout ${name}`);
+    };
     return {
         onNotification(listener) {
             notificationListeners.add(listener);
@@ -213,23 +287,25 @@ export function createCodexAppServerManager(args) {
             const activeClient = await getClient();
             return await activeClient.request(method, params, timeoutMs);
         },
-        async restart(reason) {
-            generation += 1;
-            const activeClient = client;
-            const activeProxy = providerProxy;
-            client = null;
-            providerProxy = null;
-            createPromise = null;
-            if (!activeClient) {
-                args.onLog?.(`codex app-server restart requested before start reason=${reason}`);
-                return;
-            }
-            args.onLog?.(`restarting codex app-server reason=${reason}`);
-            await activeClient.stop();
-            await activeProxy?.stop().catch((error) => {
-                args.onLog?.(`failed to stop provider proxy: ${error instanceof Error ? error.message : String(error)}`);
+        async relayMcpOauthCallback(path, search) {
+            await getClient();
+            return await relayMcpOauthCallbackToLocalListener({
+                callbackPort: await resolveMcpOauthCallbackPort(),
+                callbackPathPrefix: mcpOauthCallbackPathPrefix,
+                path,
+                search,
             });
         },
+        async logoutMcpServer(name) {
+            const normalizedName = name.trim();
+            if (!/^[A-Za-z0-9_-]+$/.test(normalizedName)) {
+                throw new Error("Invalid MCP server name");
+            }
+            await runMcpLogout(normalizedName);
+        },
+        async restart(reason) {
+            await restartClient(reason);
+        },
         async stop() {
             const activeClient = client;
             const activeProxy = providerProxy;

package/dist/mcp-oauth-relay.js

@@ -0,0 +1,64 @@
+import net from "node:net";
+const MAX_CALLBACK_QUERY_LENGTH = 16_384;
+const MAX_CALLBACK_BODY_LENGTH = 512_000;
+export function buildMcpOauthCallbackBaseUrl(args) {
+    const url = new URL(`/api/mcp-oauth/callback/${encodeURIComponent(args.userId)}/${encodeURIComponent(args.agentId)}`, `${args.serverBaseUrl.replace(/\/+$/, "")}/`);
+    return url.toString().replace(/\/$/, "");
+}
+export async function allocateMcpOauthCallbackPort() {
+    return await new Promise((resolve, reject) => {
+        const server = net.createServer();
+        server.unref();
+        server.once("error", reject);
+        server.listen(0, "0.0.0.0", () => {
+            const address = server.address();
+            if (!address || typeof address === "string") {
+                server.close();
+                reject(new Error("Failed to allocate MCP OAuth callback port"));
+                return;
+            }
+            const port = address.port;
+            server.close((error) => {
+                if (error) {
+                    reject(error);
+                    return;
+                }
+                resolve(port);
+            });
+        });
+    });
+}
+export async function relayMcpOauthCallbackToLocalListener(args) {
+    if (!Number.isInteger(args.callbackPort) || args.callbackPort < 1 || args.callbackPort > 65_535) {
+        throw new Error("MCP OAuth callback listener is unavailable");
+    }
+    if (!args.path.startsWith(`${args.callbackPathPrefix}/`)) {
+        throw new Error("Invalid MCP OAuth callback path");
+    }
+    if (args.search.length > MAX_CALLBACK_QUERY_LENGTH) {
+        throw new Error("MCP OAuth callback query is too large");
+    }
+    const target = new URL(`http://127.0.0.1:${args.callbackPort}`);
+    target.pathname = args.path;
+    target.search = args.search;
+    const response = await fetch(target, {
+        method: "GET",
+        redirect: "manual",
+        signal: AbortSignal.timeout(30_000),
+    });
+    const body = await response.text();
+    if (body.length > MAX_CALLBACK_BODY_LENGTH) {
+        throw new Error("MCP OAuth callback response is too large");
+    }
+    const headers = {};
+    for (const name of ["content-type", "location", "cache-control"]) {
+        const value = response.headers.get(name);
+        if (value)
+            headers[name] = value;
+    }
+    return {
+        status: response.status,
+        headers,
+        body,
+    };
+}

package/dist/mcp-oauth-relay.test.js

@@ -0,0 +1,43 @@
+import assert from "node:assert/strict";
+import http from "node:http";
+import test from "node:test";
+import { buildMcpOauthCallbackBaseUrl, relayMcpOauthCallbackToLocalListener, } from "./mcp-oauth-relay.js";
+test("buildMcpOauthCallbackBaseUrl scopes callbacks to the user and agent", () => {
+    assert.equal(buildMcpOauthCallbackBaseUrl({
+        serverBaseUrl: "https://doer.example.com/",
+        userId: "user id",
+        agentId: "agent/id",
+    }), "https://doer.example.com/api/mcp-oauth/callback/user%20id/agent%2Fid");
+});
+test("relayMcpOauthCallbackToLocalListener preserves the callback path and query", async () => {
+    const server = http.createServer((request, response) => {
+        response.statusCode = 200;
+        response.setHeader("content-type", "text/html; charset=utf-8");
+        response.end(`<p>${request.url}</p>`);
+    });
+    await new Promise((resolve) => server.listen(0, "127.0.0.1", resolve));
+    const address = server.address();
+    assert.ok(address && typeof address !== "string");
+    try {
+        const result = await relayMcpOauthCallbackToLocalListener({
+            callbackPort: address.port,
+            callbackPathPrefix: "/api/mcp-oauth/callback/user/agent",
+            path: "/api/mcp-oauth/callback/user/agent/callback-id",
+            search: "?code=abc&state=xyz",
+        });
+        assert.equal(result.status, 200);
+        assert.equal(result.headers["content-type"], "text/html; charset=utf-8");
+        assert.equal(result.body, "<p>/api/mcp-oauth/callback/user/agent/callback-id?code=abc&state=xyz</p>");
+    }
+    finally {
+        await new Promise((resolve, reject) => server.close((error) => error ? reject(error) : resolve()));
+    }
+});
+test("relayMcpOauthCallbackToLocalListener rejects callbacks outside the configured path", async () => {
+    await assert.rejects(relayMcpOauthCallbackToLocalListener({
+        callbackPort: 4321,
+        callbackPathPrefix: "/api/mcp-oauth/callback/user/agent",
+        path: "/api/mcp-oauth/callback/other/agent/callback-id",
+        search: "",
+    }), /Invalid MCP OAuth callback path/);
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "doer-agent",
-  "version": "0.9.5",
+  "version": "0.9.6",
   "description": "Reverse-polling agent runtime for doer",
   "type": "module",
   "main": "dist/agent.js",