doer-agent 0.9.5 → 0.9.7

package/dist/agent-codex-app-rpc.js

@@ -65,7 +65,25 @@ function normalizeCodexAppRpcRequest(args) {
     const timeoutMs = typeof args.request.timeoutMs === "number" && Number.isFinite(args.request.timeoutMs)
         ? Math.min(180_000, Math.max(1_000, Math.trunc(args.request.timeoutMs)))
         : undefined;
-    if (!requestId || !requestAgentId || requestAgentId !== args.agentId || actionRaw !== "request" || !method) {
+    if (!requestId || !requestAgentId || requestAgentId !== args.agentId) {
+        throw new Error("invalid codex app rpc request");
+    }
+    if (actionRaw === "mcp-oauth-callback") {
+        const path = typeof args.request.path === "string" ? args.request.path.trim() : "";
+        const search = typeof args.request.search === "string" ? args.request.search.trim() : "";
+        if (!path.startsWith("/") || search.length > 16_384) {
+            throw new Error("invalid MCP OAuth callback request");
+        }
+        return { requestId, action: "mcp-oauth-callback", path, search };
+    }
+    if (actionRaw === "mcp-oauth-logout") {
+        const name = typeof args.request.name === "string" ? args.request.name.trim() : "";
+        if (!/^[A-Za-z0-9_-]+$/.test(name)) {
+            throw new Error("invalid MCP OAuth logout request");
+        }
+        return { requestId, action: "mcp-oauth-logout", name };
+    }
+    if (actionRaw !== "request" || !method) {
         throw new Error("invalid codex app rpc request");
     }
     return {
@@ -82,7 +100,11 @@ async function handleCodexAppRpcMessage(args) {
         const payload = JSON.parse(codexAppRpcCodec.decode(args.msg.data));
         const request = normalizeCodexAppRpcRequest({ request: payload, agentId: args.agentId });
         requestId = request.requestId;
-        const result = applyCodexAppRpcOmitRules(request.method, await args.manager.request(request.method, request.params, request.timeoutMs));
+        const result = request.action === "request"
+            ? applyCodexAppRpcOmitRules(request.method, await args.manager.request(request.method, request.params, request.timeoutMs))
+            : request.action === "mcp-oauth-callback"
+                ? await args.manager.relayMcpOauthCallback(request.path, request.search)
+                : await args.manager.logoutMcpServer(request.name);
         args.msg.respond(codexAppRpcCodec.encode(JSON.stringify({
             requestId,
             ok: true,

package/dist/agent-codex-cli.js

@@ -41,6 +41,9 @@ function buildRemoteMcpServerConfigArgs(args) {
         "--config",
         `${prefix}.enabled=${args.enabled === false ? "false" : "true"}`,
     ];
+    if (args.auth) {
+        configArgs.push("--config", `${prefix}.auth=${toTomlStringLiteral(args.auth)}`);
+    }
     if (args.bearerTokenEnvVar?.trim()) {
         configArgs.push("--config", `${prefix}.bearer_token_env_var=${toTomlStringLiteral(args.bearerTokenEnvVar.trim())}`);
     }
@@ -50,6 +53,12 @@ function buildRemoteMcpServerConfigArgs(args) {
     if (Object.keys(args.envHttpHeaders ?? {}).length > 0) {
         configArgs.push("--config", `${prefix}.env_http_headers=${toTomlStringMap(args.envHttpHeaders ?? {})}`);
     }
+    if ((args.scopes ?? []).length > 0) {
+        configArgs.push("--config", `${prefix}.scopes=${toTomlStringArray(args.scopes ?? [])}`);
+    }
+    if (args.oauthResource?.trim()) {
+        configArgs.push("--config", `${prefix}.oauth_resource=${toTomlStringLiteral(args.oauthResource.trim())}`);
+    }
     return configArgs;
 }
 function hasDirectCodexBinary() {
@@ -157,7 +166,10 @@ export function buildCustomMcpConfigArgs(servers) {
             configArgs.push(...buildRemoteMcpServerConfigArgs({
                 serverName,
                 url: server.url,
+                auth: server.auth,
                 bearerTokenEnvVar: server.bearerTokenEnvVar,
+                scopes: server.scopes,
+                oauthResource: server.oauthResource,
                 httpHeaders: Object.fromEntries(server.httpHeaders.map((header) => [header.key, header.value])),
                 envHttpHeaders: Object.fromEntries(server.envHttpHeaders.map((header) => [header.key, header.value])),
                 enabled: true,

package/dist/agent-codex-cli.test.js

@@ -9,7 +9,10 @@ test("buildCustomMcpConfigArgs builds streamable HTTP MCP overrides", () => {
             args: [],
             env: [],
             url: "https://example.com/mcp",
+            auth: "oauth",
             bearerTokenEnvVar: "MCP_TOKEN",
+            scopes: ["read:docs"],
+            oauthResource: "https://example.com/",
             httpHeaders: [{ key: "X-Region", value: "seoul" }],
             envHttpHeaders: [{ key: "X-API-Key", value: "MCP_API_KEY" }],
             enabled: true,
@@ -17,9 +20,12 @@ test("buildCustomMcpConfigArgs builds streamable HTTP MCP overrides", () => {
     assert.deepEqual(args, [
         "--config", 'mcp_servers.remote_docs.url="https://example.com/mcp"',
         "--config", "mcp_servers.remote_docs.enabled=true",
+        "--config", 'mcp_servers.remote_docs.auth="oauth"',
         "--config", 'mcp_servers.remote_docs.bearer_token_env_var="MCP_TOKEN"',
         "--config", 'mcp_servers.remote_docs.http_headers={ "X-Region" = "seoul" }',
         "--config", 'mcp_servers.remote_docs.env_http_headers={ "X-API-Key" = "MCP_API_KEY" }',
+        "--config", 'mcp_servers.remote_docs.scopes=["read:docs"]',
+        "--config", 'mcp_servers.remote_docs.oauth_resource="https://example.com/"',
     ]);
 });
 test("buildCustomMcpConfigArgs keeps stdio MCP overrides", () => {
@@ -30,7 +36,10 @@ test("buildCustomMcpConfigArgs keeps stdio MCP overrides", () => {
             args: ["-y", "local-mcp"],
             env: [{ key: "LOCAL_TOKEN", value: "secret" }],
             url: "",
+            auth: "oauth",
             bearerTokenEnvVar: "",
+            scopes: [],
+            oauthResource: "",
             httpHeaders: [],
             envHttpHeaders: [],
             enabled: true,

package/dist/agent-settings.js

@@ -237,7 +237,10 @@ function normalizeAgentMcpServer(value) {
         args: normalizeStringArray(raw.args),
         env,
         url,
+        auth: raw.auth === "chatgpt" ? "chatgpt" : "oauth",
         bearerTokenEnvVar: typeof raw.bearerTokenEnvVar === "string" ? raw.bearerTokenEnvVar.trim() : "",
+        scopes: normalizeStringArray(raw.scopes),
+        oauthResource: typeof raw.oauthResource === "string" ? raw.oauthResource.trim() : "",
         httpHeaders: normalizeMcpHeaderEntries(raw.httpHeaders),
         envHttpHeaders: normalizeMcpHeaderEntries(raw.envHttpHeaders),
         enabled: raw.enabled !== false,
@@ -423,7 +426,10 @@ export async function toAgentSettingsPublic(args) {
                     value: variable.value,
                 })),
                 url: server.url,
+                auth: server.auth,
                 bearerTokenEnvVar: server.bearerTokenEnvVar,
+                scopes: [...server.scopes],
+                oauthResource: server.oauthResource,
                 httpHeaders: server.httpHeaders.map((header) => ({ ...header })),
                 envHttpHeaders: server.envHttpHeaders.map((header) => ({ ...header })),
                 enabled: server.enabled,

package/dist/agent-thread-tags-rpc.js

@@ -1,5 +1,5 @@
 import crypto from "node:crypto";
-import { mkdir, readFile, rename, writeFile } from "node:fs/promises";
+import { mkdir, readFile, readdir, rename, stat, writeFile } from "node:fs/promises";
 import path from "node:path";
 import { StringCodec } from "nats";
 import { runCodexTextTask } from "./codex-text-task.js";
@@ -9,6 +9,8 @@ const MAX_THREADS_PER_REBUILD = 2_000;
 const MAX_TAGS = 12;
 const MIN_TAGS = 2;
 const OTHER_TAG_ID = "other";
+const MAX_REPOSITORIES = 200;
+const MAX_RELATED_REPOS = 3;
 const DEFAULT_TAGS = [
     { id: "deployment", label: "Deployment", description: "Deploy, release, publish, production rollout, or app-store delivery.", color: "#8b5cf6" },
     { id: "bug", label: "Bug · diagnosis", description: "Debugging, errors, failures, regressions, diagnosis, or fixes.", color: "#ef4444" },
@@ -55,6 +57,70 @@ function tagsFilePath(workspaceRoot, threadId) {
 function configFilePath(workspaceRoot) {
     return path.join(workspaceRoot, ".doer-agent", "thread-tags", "config.json");
 }
+async function isGitRepository(directoryPath) {
+    try {
+        const gitEntry = await stat(path.join(directoryPath, ".git"));
+        return gitEntry.isDirectory() || gitEntry.isFile();
+    }
+    catch {
+        return false;
+    }
+}
+function repositoryCandidate(workspaceRoot, absolutePath) {
+    const relativePath = path.relative(workspaceRoot, absolutePath).split(path.sep).join("/") || ".";
+    return {
+        id: relativePath,
+        label: path.basename(absolutePath),
+        relativePath,
+        absolutePath,
+    };
+}
+export async function discoverWorkspaceRepositories(workspaceRoot) {
+    const resolvedRoot = path.resolve(workspaceRoot);
+    const candidates = [];
+    if (await isGitRepository(resolvedRoot)) {
+        candidates.push(repositoryCandidate(resolvedRoot, resolvedRoot));
+    }
+    const entries = await readdir(resolvedRoot, { withFileTypes: true }).catch(() => []);
+    for (const entry of entries) {
+        if (candidates.length >= MAX_REPOSITORIES ||
+            !entry.isDirectory() ||
+            entry.name.startsWith(".")) {
+            continue;
+        }
+        const absolutePath = path.join(resolvedRoot, entry.name);
+        if (await isGitRepository(absolutePath)) {
+            candidates.push(repositoryCandidate(resolvedRoot, absolutePath));
+        }
+    }
+    return candidates.sort((left, right) => (left.label.localeCompare(right.label) || left.id.localeCompare(right.id)));
+}
+function repositoryFingerprint(repositories) {
+    return crypto.createHash("sha256").update(JSON.stringify(repositories.map((repository) => ({
+        id: repository.id,
+        label: repository.label,
+        relativePath: repository.relativePath,
+    })))).digest("hex");
+}
+function pathIsWithin(candidatePath, targetPath) {
+    const relative = path.relative(candidatePath, targetPath);
+    return relative === "" || (!relative.startsWith("..") && !path.isAbsolute(relative));
+}
+export function relatedReposFromCwd(cwd, repositories) {
+    if (!cwd) {
+        return [];
+    }
+    const resolvedCwd = path.resolve(cwd);
+    const repository = repositories
+        .filter((candidate) => pathIsWithin(candidate.absolutePath, resolvedCwd))
+        .sort((left, right) => right.absolutePath.length - left.absolutePath.length)[0];
+    return repository ? [{
+            id: repository.id,
+            label: repository.label,
+            confidence: 1,
+            source: "cwd",
+        }] : [];
+}
 function normalizeInputs(value, limit) {
     const rows = Array.isArray(value) ? value.slice(0, limit) : [];
     const seen = new Set();
@@ -191,9 +257,10 @@ function jsonObjectFromText(text) {
     }
     return payload;
 }
-export function parseThreadTagClassificationResponse(text, requestedThreadIds, allowedTagIds = new Set(DEFAULT_TAGS.map((tag) => tag.id))) {
+export function parseThreadTagClassificationResponse(text, requestedThreadIds, allowedTagIds = new Set(DEFAULT_TAGS.map((tag) => tag.id)), repositories = []) {
     const payload = jsonObjectFromText(text);
     const assignments = Array.isArray(payload.assignments) ? payload.assignments : [];
+    const repositoriesById = new Map(repositories.map((repository) => [repository.id, repository]));
     const seen = new Set();
     const results = [];
     for (const assignmentValue of assignments) {
@@ -207,11 +274,30 @@ export function parseThreadTagClassificationResponse(text, requestedThreadIds, a
             continue;
         }
         seen.add(threadId);
+        const seenRepositoryIds = new Set();
+        const relatedRepos = (Array.isArray(assignment?.relatedRepos) ? assignment.relatedRepos : [])
+            .flatMap((value) => {
+            const row = recordValue(value);
+            const id = stringValue(row?.id) || stringValue(value);
+            const repository = repositoriesById.get(id);
+            if (!repository || seenRepositoryIds.has(id)) {
+                return [];
+            }
+            seenRepositoryIds.add(id);
+            return [{
+                    id: repository.id,
+                    label: repository.label,
+                    confidence: boundedConfidence(row?.confidence),
+                    source: "ai",
+                }];
+        })
+            .slice(0, MAX_RELATED_REPOS);
         results.push({
             threadId,
             activityTag,
             confidence: boundedConfidence(assignment?.confidence),
             source: "ai",
+            relatedRepos,
         });
     }
     return results;
@@ -219,41 +305,61 @@ export function parseThreadTagClassificationResponse(text, requestedThreadIds, a
 export function parseSuggestedThreadTags(text) {
     return normalizeTagDefinitions(jsonObjectFromText(text).tags);
 }
-async function readStoredTags(workspaceRoot, input, config) {
+async function readStoredTags(workspaceRoot, input, config, repositories) {
     try {
         const row = recordValue(JSON.parse(await readFile(tagsFilePath(workspaceRoot, input.threadId), "utf8")));
         const activityTag = sanitizeTagId(stringValue(row?.activityTag));
         const allowedTagIds = new Set(config.tags.map((tag) => tag.id));
-        const isLegacyDefaultCache = row?.version === 1 && config.source === "default";
-        const isCurrentCache = row?.version === 2 && stringValue(row.configFingerprint) === config.fingerprint;
-        if ((!isLegacyDefaultCache && !isCurrentCache) ||
+        const isCurrentCache = row?.version === 3 &&
+            stringValue(row.configFingerprint) === config.fingerprint &&
+            stringValue(row.repositoryFingerprint) === repositoryFingerprint(repositories);
+        if (!isCurrentCache ||
             stringValue(row?.threadId) !== input.threadId ||
             stringValue(row?.contentFingerprint) !== contentFingerprint(input) ||
             !allowedTagIds.has(activityTag)) {
             return null;
         }
+        const repositoriesById = new Map(repositories.map((repository) => [repository.id, repository]));
+        const relatedRepos = (Array.isArray(row?.relatedRepos) ? row.relatedRepos : [])
+            .flatMap((value) => {
+            const stored = recordValue(value);
+            const repository = repositoriesById.get(stringValue(stored?.id));
+            if (!repository) {
+                return [];
+            }
+            return [{
+                    id: repository.id,
+                    label: repository.label,
+                    confidence: boundedConfidence(stored?.confidence),
+                    source: stored?.source === "cwd" ? "cwd" : "ai",
+                }];
+        })
+            .slice(0, MAX_RELATED_REPOS);
         return {
             threadId: input.threadId,
             activityTag,
             confidence: boundedConfidence(row?.confidence),
             source: "ai",
+            relatedRepos,
         };
     }
     catch {
         return null;
     }
 }
-async function writeStoredTags(workspaceRoot, input, classification, config) {
+async function writeStoredTags(workspaceRoot, input, classification, config, repositories) {
     const filePath = tagsFilePath(workspaceRoot, input.threadId);
     await mkdir(path.dirname(filePath), { recursive: true });
     const tempPath = `${filePath}.${process.pid}.${Date.now()}.tmp`;
     const payload = {
-        version: 2,
+        version: 3,
         threadId: input.threadId,
         contentFingerprint: contentFingerprint(input),
         configFingerprint: config.fingerprint,
+        repositoryFingerprint: repositoryFingerprint(repositories),
         activityTag: classification.activityTag,
         confidence: classification.confidence,
+        relatedRepos: classification.relatedRepos,
         source: "ai",
         updatedAt: new Date().toISOString(),
     };
@@ -263,15 +369,23 @@ async function writeStoredTags(workspaceRoot, input, classification, config) {
 function configuredTagsPrompt(tags) {
     return tags.map((tag) => `- ${tag.id} (${tag.label}): ${tag.description}`);
 }
-function classifierPrompt(inputs, tags) {
+function classifierPrompt(inputs, tags, repositories) {
     return [
         "You classify Codex threads inside Doer.",
         "Return only one valid JSON object. Do not use Markdown fences or add explanations.",
         "Classify every input thread into exactly one activityTag from the configured list.",
         "Configured activityTag values:",
         ...configuredTagsPrompt(tags),
-        "Use label and preview as the main evidence. Use cwd only as supporting project context.",
-        `Output shape: {"assignments":[{"threadId":"...","activityTag":"${tags[0]?.id ?? OTHER_TAG_ID}","confidence":0.9}]}`,
+        "Also select zero to three relatedRepos for each thread from the repository candidates below.",
+        "A related repository is a code repository that the thread discusses, inspects, modifies, tests, deploys, or otherwise directly works on.",
+        "Do not invent repository ids and do not select a repository merely because it shares the agent workspace.",
+        `Repository candidates: ${JSON.stringify(repositories.map((repository) => ({
+            id: repository.id,
+            label: repository.label,
+            relativePath: repository.relativePath,
+        })))}`,
+        "Use label and preview as the main evidence. Use cwd as strong supporting repository evidence.",
+        `Output shape: {"assignments":[{"threadId":"...","activityTag":"${tags[0]?.id ?? OTHER_TAG_ID}","confidence":0.9,"relatedRepos":[{"id":"repository-id","confidence":0.9}]}]}`,
         "",
         JSON.stringify({ threads: inputs }),
     ].join("\n");
@@ -284,7 +398,7 @@ function suggestionPrompt(inputs, candidateTags) {
         "Every tag needs: a stable lowercase kebab-case id, a concise label, a one-sentence classification description, and a distinct #RRGGBB color.",
         "Write labels and descriptions in the predominant language of the supplied threads. Use Korean when the threads are predominantly Korean.",
         `Always include "${OTHER_TAG_ID}" as the final fallback tag.`,
-        "Avoid tags for project paths or running status; those are managed separately.",
+        "Avoid tags for repositories or running status; those are managed separately.",
         "Prefer work-intent categories that will remain useful for future threads.",
         'Output shape: {"tags":[{"id":"feature","label":"Feature","description":"Implementation and product changes.","color":"#22c55e"}]}',
         candidateTags?.length
@@ -299,12 +413,30 @@ function suggestionPrompt(inputs, candidateTags) {
         })}` : "",
     ].filter(Boolean).join("\n");
 }
+function withCwdRelatedRepos(classification, input, repositories) {
+    const merged = new Map();
+    for (const relatedRepo of classification.relatedRepos) {
+        merged.set(relatedRepo.id, relatedRepo);
+    }
+    for (const relatedRepo of relatedReposFromCwd(input.cwd, repositories)) {
+        merged.set(relatedRepo.id, relatedRepo);
+    }
+    return {
+        ...classification,
+        relatedRepos: [...merged.values()]
+            .sort((left, right) => (Number(right.source === "cwd") - Number(left.source === "cwd")
+            || right.confidence - left.confidence
+            || left.label.localeCompare(right.label)))
+            .slice(0, MAX_RELATED_REPOS),
+    };
+}
 async function classifyThreads(args) {
     const config = await readConfig(args.workspaceRoot);
+    const repositories = await discoverWorkspaceRepositories(args.workspaceRoot);
     const classifications = new Map();
     const staleInputs = [];
     for (const input of args.inputs) {
-        const stored = args.force ? null : await readStoredTags(args.workspaceRoot, input, config);
+        const stored = args.force ? null : await readStoredTags(args.workspaceRoot, input, config, repositories);
         if (stored) {
             classifications.set(input.threadId, stored);
         }
@@ -317,17 +449,18 @@ async function classifyThreads(args) {
         try {
             const resultText = await runCodexTextTask({
                 manager: args.manager,
-                prompt: classifierPrompt(staleInputs, config.tags),
+                prompt: classifierPrompt(staleInputs, config.tags, repositories),
             });
-            const resolved = parseThreadTagClassificationResponse(resultText, new Set(staleInputs.map((input) => input.threadId)), new Set(config.tags.map((tag) => tag.id)));
+            const resolved = parseThreadTagClassificationResponse(resultText, new Set(staleInputs.map((input) => input.threadId)), new Set(config.tags.map((tag) => tag.id)), repositories);
             const inputsById = new Map(staleInputs.map((input) => [input.threadId, input]));
             await Promise.all(resolved.map(async (classification) => {
                 const input = inputsById.get(classification.threadId);
                 if (!input) {
                     return;
                 }
-                await writeStoredTags(args.workspaceRoot, input, classification, config);
-                classifications.set(classification.threadId, classification);
+                const completedClassification = withCwdRelatedRepos(classification, input, repositories);
+                await writeStoredTags(args.workspaceRoot, input, completedClassification, config, repositories);
+                classifications.set(classification.threadId, completedClassification);
             }));
             if (resolved.length !== staleInputs.length) {
                 classificationError = `AI classified ${resolved.length} of ${staleInputs.length} threads`;

package/dist/agent-thread-tags-rpc.test.js

@@ -1,6 +1,9 @@
 import assert from "node:assert/strict";
+import { mkdir, mkdtemp, rm, writeFile } from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
 import test from "node:test";
-import { parseSuggestedThreadTags, parseThreadTagClassificationResponse, } from "./agent-thread-tags-rpc.js";
+import { discoverWorkspaceRepositories, parseSuggestedThreadTags, parseThreadTagClassificationResponse, relatedReposFromCwd, } from "./agent-thread-tags-rpc.js";
 test("parses only requested valid thread tag assignments", () => {
     const result = parseThreadTagClassificationResponse(JSON.stringify({
         assignments: [
@@ -14,6 +17,7 @@ test("parses only requested valid thread tag assignments", () => {
             activityTag: "feature",
             confidence: 0.91,
             source: "ai",
+            relatedRepos: [],
         }]);
 });
 test("accepts fenced JSON and clamps confidence", () => {
@@ -24,6 +28,58 @@ test("accepts classifications from a custom configured range", () => {
     const result = parseThreadTagClassificationResponse("{\"assignments\":[{\"threadId\":\"a\",\"activityTag\":\"customer-request\",\"confidence\":0.8}]}", new Set(["a"]), new Set(["customer-request", "other"]));
     assert.equal(result[0]?.activityTag, "customer-request");
 });
+test("accepts only configured related repository ids", () => {
+    const repositories = [{
+            id: "doer",
+            label: "doer",
+            relativePath: "doer",
+            absolutePath: "/workspace/doer",
+        }];
+    const result = parseThreadTagClassificationResponse(JSON.stringify({
+        assignments: [{
+                threadId: "a",
+                activityTag: "feature",
+                confidence: 0.9,
+                relatedRepos: [
+                    { id: "doer", confidence: 0.82 },
+                    { id: "invented", confidence: 1 },
+                ],
+            }],
+    }), new Set(["a"]), new Set(["feature", "other"]), repositories);
+    assert.deepEqual(result[0]?.relatedRepos, [{
+            id: "doer",
+            label: "doer",
+            confidence: 0.82,
+            source: "ai",
+        }]);
+});
+test("uses the most specific repository containing cwd", () => {
+    const repositories = [
+        { id: ".", label: "workspace", relativePath: ".", absolutePath: "/workspace" },
+        { id: "doer", label: "doer", relativePath: "doer", absolutePath: "/workspace/doer" },
+    ];
+    assert.deepEqual(relatedReposFromCwd("/workspace/doer/src", repositories), [{
+            id: "doer",
+            label: "doer",
+            confidence: 1,
+            source: "cwd",
+        }]);
+});
+test("discovers the workspace root and immediate child git repositories", async () => {
+    const root = await mkdtemp(path.join(os.tmpdir(), "doer-thread-repos-"));
+    try {
+        await mkdir(path.join(root, ".git"));
+        await mkdir(path.join(root, "child", ".git"), { recursive: true });
+        await mkdir(path.join(root, "not-a-repo"), { recursive: true });
+        await mkdir(path.join(root, "worktree"), { recursive: true });
+        await writeFile(path.join(root, "worktree", ".git"), "gitdir: ../actual\n", "utf8");
+        const repositories = await discoverWorkspaceRepositories(root);
+        assert.deepEqual(repositories.map((repository) => repository.id).sort(), [".", "child", "worktree"]);
+    }
+    finally {
+        await rm(root, { recursive: true, force: true });
+    }
+});
 test("normalizes AI suggested tags and always adds other", () => {
     const result = parseSuggestedThreadTags(JSON.stringify({
         tags: [

package/dist/codex-app-server-manager.js

@@ -1,7 +1,8 @@
 import { buildAgentSettingsEnvPatch, readAgentModelInstructions, resolveAgentModelInstructionsFilePath, } from "./agent-settings.js";
-import { buildCustomMcpConfigArgs, buildDaemonMcpConfigArgs, buildMobileMcpConfigArgs, buildThreadsMcpConfigArgs } from "./agent-codex-cli.js";
+import { buildCustomMcpConfigArgs, buildDaemonMcpConfigArgs, buildMobileMcpConfigArgs, buildThreadsMcpConfigArgs, spawnManagedCodexCommand, } from "./agent-codex-cli.js";
 import { CodexAppServerClient } from "./codex-app-server-client.js";
 import { startCodexChatBridge } from "./codex-chat-bridge.js";
+import { allocateMcpOauthCallbackPort, buildMcpOauthCallbackBaseUrl, relayMcpOauthCallbackToLocalListener, } from "./mcp-oauth-relay.js";
 function toTomlStringLiteral(value) {
     return `"${value.replace(/\\/g, "\\\\").replace(/"/g, '\\"')}"`;
 }
@@ -59,6 +60,8 @@ async function buildCodexAppServerArgs(args) {
         ...buildConfigArg("personality", toTomlStringLiteral(args.settings.general.personality)),
         ...buildConfigArg("approval_policy", toTomlStringLiteral("never")),
         ...buildConfigArg("sandbox_mode", toTomlStringLiteral("danger-full-access")),
+        ...buildConfigArg("mcp_oauth_callback_port", String(args.mcpOauthCallbackPort)),
+        ...buildConfigArg("mcp_oauth_callback_url", toTomlStringLiteral(args.mcpOauthCallbackUrl)),
     ];
     const customInstructions = await readAgentModelInstructions(args.workspaceRoot);
     if (customInstructions) {
@@ -140,18 +143,34 @@ export function createCodexAppServerManager(args) {
     let client = null;
     let providerProxy = null;
     let createPromise = null;
+    let mcpOauthCallbackPortPromise = null;
     let generation = 0;
     const notificationListeners = new Set();
+    const mcpOauthCallbackUrl = buildMcpOauthCallbackBaseUrl({
+        serverBaseUrl: args.serverBaseUrl,
+        userId: args.userId,
+        agentId: args.agentId,
+    });
+    const mcpOauthCallbackPathPrefix = new URL(mcpOauthCallbackUrl).pathname;
+    const resolveMcpOauthCallbackPort = async () => {
+        if (!mcpOauthCallbackPortPromise) {
+            mcpOauthCallbackPortPromise = allocateMcpOauthCallbackPort();
+        }
+        return await mcpOauthCallbackPortPromise;
+    };
     const createClient = async () => {
         const settings = await args.readAgentSettingsConfig({ workspaceRoot: args.workspaceRoot });
         const resolved = await resolveAppServerSettings({ settings, onLog: args.onLog });
         providerProxy = resolved.proxy;
+        const mcpOauthCallbackPort = await resolveMcpOauthCallbackPort();
         const appServerArgs = await buildCodexAppServerArgs({
             agentId: args.agentId,
             agentToken: args.agentToken,
             workspaceRoot: args.workspaceRoot,
             agentProjectDir: args.agentProjectDir,
             serverBaseUrl: args.serverBaseUrl,
+            mcpOauthCallbackPort,
+            mcpOauthCallbackUrl,
             settings: resolved.settings,
             userId: args.userId,
         });
@@ -164,7 +183,7 @@ export function createCodexAppServerManager(args) {
             settings: resolved.settings,
             userId: args.userId,
         });
-        args.onLog?.(`starting codex app-server model=${resolveCodexModel(resolved.settings)} reasoningEffort=${resolved.settings.codex.reasoningEffort} personality=${resolved.settings.general.personality} computerUse=${resolved.settings.codex.computerUseEnabled} browserUse=${resolved.settings.codex.browserUseEnabled} mcpServers=${resolved.settings.mcp.servers.filter((server) => server.enabled).length}`);
+        args.onLog?.(`starting codex app-server model=${resolveCodexModel(resolved.settings)} reasoningEffort=${resolved.settings.codex.reasoningEffort} personality=${resolved.settings.general.personality} computerUse=${resolved.settings.codex.computerUseEnabled} browserUse=${resolved.settings.codex.browserUseEnabled} mcpServers=${resolved.settings.mcp.servers.filter((server) => server.enabled).length} mcpOauthCallbackPort=${mcpOauthCallbackPort}`);
         return new CodexAppServerClient({
             cwd: args.workspaceRoot,
             args: appServerArgs,
@@ -202,6 +221,61 @@ export function createCodexAppServerManager(args) {
             }
         }
     };
+    const restartClient = async (reason) => {
+        generation += 1;
+        const activeClient = client;
+        const activeProxy = providerProxy;
+        client = null;
+        providerProxy = null;
+        createPromise = null;
+        if (!activeClient) {
+            args.onLog?.(`codex app-server restart requested before start reason=${reason}`);
+            return;
+        }
+        args.onLog?.(`restarting codex app-server reason=${reason}`);
+        await activeClient.stop();
+        await activeProxy?.stop().catch((error) => {
+            args.onLog?.(`failed to stop provider proxy: ${error instanceof Error ? error.message : String(error)}`);
+        });
+    };
+    const runMcpLogout = async (name) => {
+        const settings = await args.readAgentSettingsConfig({ workspaceRoot: args.workspaceRoot });
+        const server = settings.mcp.servers.find((candidate) => candidate.name === name && candidate.transport === "streamable_http");
+        if (!server) {
+            throw new Error("Remote MCP server not found");
+        }
+        const env = await buildCodexAppServerEnv({
+            agentId: args.agentId,
+            agentToken: args.agentToken,
+            workspaceRoot: args.workspaceRoot,
+            serverBaseUrl: args.serverBaseUrl,
+            resolveCodexHomePath: args.resolveCodexHomePath,
+            settings,
+            userId: args.userId,
+        });
+        const child = spawnManagedCodexCommand({
+            codexArgs: ["mcp", "logout", name, ...buildCustomMcpConfigArgs([server])],
+            taskWorkspace: args.workspaceRoot,
+            env,
+            agentToken: args.agentToken,
+        });
+        let stdout = "";
+        let stderr = "";
+        child.stdout?.on("data", (chunk) => {
+            stdout = `${stdout}${chunk}`.slice(-16_384);
+        });
+        child.stderr?.on("data", (chunk) => {
+            stderr = `${stderr}${chunk}`.slice(-16_384);
+        });
+        const exitCode = await new Promise((resolve, reject) => {
+            child.once("error", reject);
+            child.once("exit", resolve);
+        });
+        if (exitCode !== 0) {
+            throw new Error(stderr.trim() || stdout.trim() || `MCP OAuth logout failed with exit code ${exitCode ?? "unknown"}`);
+        }
+        await restartClient(`mcp oauth logout ${name}`);
+    };
     return {
         onNotification(listener) {
             notificationListeners.add(listener);
@@ -213,23 +287,25 @@ export function createCodexAppServerManager(args) {
             const activeClient = await getClient();
             return await activeClient.request(method, params, timeoutMs);
         },
-        async restart(reason) {
-            generation += 1;
-            const activeClient = client;
-            const activeProxy = providerProxy;
-            client = null;
-            providerProxy = null;
-            createPromise = null;
-            if (!activeClient) {
-                args.onLog?.(`codex app-server restart requested before start reason=${reason}`);
-                return;
-            }
-            args.onLog?.(`restarting codex app-server reason=${reason}`);
-            await activeClient.stop();
-            await activeProxy?.stop().catch((error) => {
-                args.onLog?.(`failed to stop provider proxy: ${error instanceof Error ? error.message : String(error)}`);
+        async relayMcpOauthCallback(path, search) {
+            await getClient();
+            return await relayMcpOauthCallbackToLocalListener({
+                callbackPort: await resolveMcpOauthCallbackPort(),
+                callbackPathPrefix: mcpOauthCallbackPathPrefix,
+                path,
+                search,
             });
         },
+        async logoutMcpServer(name) {
+            const normalizedName = name.trim();
+            if (!/^[A-Za-z0-9_-]+$/.test(normalizedName)) {
+                throw new Error("Invalid MCP server name");
+            }
+            await runMcpLogout(normalizedName);
+        },
+        async restart(reason) {
+            await restartClient(reason);
+        },
         async stop() {
             const activeClient = client;
             const activeProxy = providerProxy;

package/dist/mcp-oauth-relay.js

@@ -0,0 +1,64 @@
+import net from "node:net";
+const MAX_CALLBACK_QUERY_LENGTH = 16_384;
+const MAX_CALLBACK_BODY_LENGTH = 512_000;
+export function buildMcpOauthCallbackBaseUrl(args) {
+    const url = new URL(`/api/mcp-oauth/callback/${encodeURIComponent(args.userId)}/${encodeURIComponent(args.agentId)}`, `${args.serverBaseUrl.replace(/\/+$/, "")}/`);
+    return url.toString().replace(/\/$/, "");
+}
+export async function allocateMcpOauthCallbackPort() {
+    return await new Promise((resolve, reject) => {
+        const server = net.createServer();
+        server.unref();
+        server.once("error", reject);
+        server.listen(0, "0.0.0.0", () => {
+            const address = server.address();
+            if (!address || typeof address === "string") {
+                server.close();
+                reject(new Error("Failed to allocate MCP OAuth callback port"));
+                return;
+            }
+            const port = address.port;
+            server.close((error) => {
+                if (error) {
+                    reject(error);
+                    return;
+                }
+                resolve(port);
+            });
+        });
+    });
+}
+export async function relayMcpOauthCallbackToLocalListener(args) {
+    if (!Number.isInteger(args.callbackPort) || args.callbackPort < 1 || args.callbackPort > 65_535) {
+        throw new Error("MCP OAuth callback listener is unavailable");
+    }
+    if (!args.path.startsWith(`${args.callbackPathPrefix}/`)) {
+        throw new Error("Invalid MCP OAuth callback path");
+    }
+    if (args.search.length > MAX_CALLBACK_QUERY_LENGTH) {
+        throw new Error("MCP OAuth callback query is too large");
+    }
+    const target = new URL(`http://127.0.0.1:${args.callbackPort}`);
+    target.pathname = args.path;
+    target.search = args.search;
+    const response = await fetch(target, {
+        method: "GET",
+        redirect: "manual",
+        signal: AbortSignal.timeout(30_000),
+    });
+    const body = await response.text();
+    if (body.length > MAX_CALLBACK_BODY_LENGTH) {
+        throw new Error("MCP OAuth callback response is too large");
+    }
+    const headers = {};
+    for (const name of ["content-type", "location", "cache-control"]) {
+        const value = response.headers.get(name);
+        if (value)
+            headers[name] = value;
+    }
+    return {
+        status: response.status,
+        headers,
+        body,
+    };
+}

package/dist/mcp-oauth-relay.test.js

@@ -0,0 +1,43 @@
+import assert from "node:assert/strict";
+import http from "node:http";
+import test from "node:test";
+import { buildMcpOauthCallbackBaseUrl, relayMcpOauthCallbackToLocalListener, } from "./mcp-oauth-relay.js";
+test("buildMcpOauthCallbackBaseUrl scopes callbacks to the user and agent", () => {
+    assert.equal(buildMcpOauthCallbackBaseUrl({
+        serverBaseUrl: "https://doer.example.com/",
+        userId: "user id",
+        agentId: "agent/id",
+    }), "https://doer.example.com/api/mcp-oauth/callback/user%20id/agent%2Fid");
+});
+test("relayMcpOauthCallbackToLocalListener preserves the callback path and query", async () => {
+    const server = http.createServer((request, response) => {
+        response.statusCode = 200;
+        response.setHeader("content-type", "text/html; charset=utf-8");
+        response.end(`<p>${request.url}</p>`);
+    });
+    await new Promise((resolve) => server.listen(0, "127.0.0.1", resolve));
+    const address = server.address();
+    assert.ok(address && typeof address !== "string");
+    try {
+        const result = await relayMcpOauthCallbackToLocalListener({
+            callbackPort: address.port,
+            callbackPathPrefix: "/api/mcp-oauth/callback/user/agent",
+            path: "/api/mcp-oauth/callback/user/agent/callback-id",
+            search: "?code=abc&state=xyz",
+        });
+        assert.equal(result.status, 200);
+        assert.equal(result.headers["content-type"], "text/html; charset=utf-8");
+        assert.equal(result.body, "<p>/api/mcp-oauth/callback/user/agent/callback-id?code=abc&state=xyz</p>");
+    }
+    finally {
+        await new Promise((resolve, reject) => server.close((error) => error ? reject(error) : resolve()));
+    }
+});
+test("relayMcpOauthCallbackToLocalListener rejects callbacks outside the configured path", async () => {
+    await assert.rejects(relayMcpOauthCallbackToLocalListener({
+        callbackPort: 4321,
+        callbackPathPrefix: "/api/mcp-oauth/callback/user/agent",
+        path: "/api/mcp-oauth/callback/other/agent/callback-id",
+        search: "",
+    }), /Invalid MCP OAuth callback path/);
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "doer-agent",
-  "version": "0.9.5",
+  "version": "0.9.7",
   "description": "Reverse-polling agent runtime for doer",
   "type": "module",
   "main": "dist/agent.js",