open-managed-agents 0.1.2 → 0.2.0

package/dist/ui/managed-agents-console/README.md

@@ -14,24 +14,31 @@ hosts.
 
 ## Logging in
 
-The console asks for a key on load (unless the server runs with
-`OMA_AUTH_MODE=disabled`, in which case it browses `wrk_default` directly):
-
-- **Workspace key** (`oma_…`, e.g. the one printed on first boot) — read-only
-  browsing of that workspace's agents, sessions, events, spans, and files,
-  including authenticated file downloads.
+The normal `oma onboard` path opens the loopback console through a short-lived,
+single-use bootstrap nonce and establishes an opaque HttpOnly browser session;
+no raw workspace key enters the URL or browser storage. A user can also enter a
+workspace key manually when no console session exists. If the server runs with
+`OMA_AUTH_MODE=disabled`, it browses `wrk_default` directly.
+
+- **Workspace key** (`oma_…`) — workspace-scoped browsing and the console's
+  narrowly allowlisted agent, environment, session, vault, credential, and
+  skill workflows, including authenticated event streams and file downloads.
 - **Admin key** (`OMA_ADMIN_KEY`) — everything above plus the Admin panel:
   create workspaces, mint/list/revoke API keys. Minted plaintext is shown
   once, with copy and a "browse as this workspace" shortcut. Setup:
   [dev-deployment.md](../../docs/dev-deployment.md#the-admin-api-and-console-admin-mode).
 
-Keys live in page memory only — never `localStorage`, `sessionStorage`, or a
-cookie (enforced by `src/control-plane/__tests__/console-security.test.ts`).
-A reload asks again.
+Raw keys are used only for the same-origin login exchange and are never stored
+in `localStorage` or `sessionStorage`. The server returns an opaque HttpOnly
+cookie whose authority is revalidated against key revocation. Reloading keeps
+the console session until it expires, is revoked, or the user signs out.
 
-Admin mutations (workspace/key CRUD) are live. `/v1` mutations — create
-agent/session, send message, interrupt, archive — remain deliberately
-disabled in this slice.
+Admin workspace/key CRUD is live. The workspace console also supports the
+reviewed mutation set required for the single-agent flow: agent creation and
+versioning/archive, environment creation/archive/delete, session creation,
+prompt/interrupt/confirmation and idle archive/delete, vault/credential
+creation, MCP validation, and custom-skill upload. Arbitrary `/v1` writes remain
+blocked by narrow client-side capability wrappers and server authorization.
 
 ## Dev server (optional)
 
@@ -47,6 +54,6 @@ expose it as a shared gateway; it forwards browser request headers to the
 configured API. Admin mode needs same-origin `/admin` routes, so use the
 appliance-served `/console` for that.
 
-Demo review mode with bundled fake data: append `?mode=demo` to either URL.
-If the API is unreachable, the console falls back to the same demo data with
-a warning banner.
+Demo review mode with bundled fake data is explicit: append `?mode=demo` to
+either URL. A failed live API request never falls back to demo data; the console
+clears live rows and renders a retryable error state.

package/dist/ui/managed-agents-console/docs/vaults.md

@@ -6,14 +6,28 @@
 
 Vaults organize workspace-scoped credentials. The console can show vault and credential metadata and health without rendering secret values. The API supports vault and credential lifecycle operations, including archive and delete where the server permits them.
 
+## Connect an OAuth MCP server
+
+OAuth connections require MCP support to be enabled on the appliance (`OMA_ENABLE_MCP=true`) and a configured secrets master key. In the console:
+
+1. Open **Vaults**, create or select a vault, and choose **Add credential**.
+2. Leave **Connect with OAuth** selected and enter the exact URL used in the agent's `mcp_servers` configuration, such as `https://mcp.notion.com/mcp`.
+3. Choose **Connect** and finish authorization in the provider window.
+
+The browser receives an authorization URL and opaque flow status only. Access tokens, refresh tokens, client secrets, and authorization codes are exchanged and encrypted by the appliance; they are never displayed or pasted into the console.
+
+This guided path supports URL-based, standards-compliant MCP servers that publish OAuth discovery metadata and either dynamic client registration or an existing reusable registration. A provider that lacks those capabilities produces an explicit unsupported-provider error. OMA does not ship a third-party MCP marketplace.
+
 ## Use a credential in a session
 
 Attach the needed vault at session creation and configure the compatible MCP server on the agent. OMA resolves supported authentication inside the connector path; the sandbox does not receive a browser-visible plaintext secret.
 
 ## Supported and deferred types
 
-OMA supports the shipped static bearer and MCP OAuth flows, including validation where configured. Environment-variable substitution and arbitrary secret injection are not current public credential types.
+OMA supports static bearer credentials and guided MCP OAuth, including validation and automatic refresh where the provider issues a refresh token. Static bearer remains available for servers that intentionally use a long-lived token. Environment-variable substitution and arbitrary secret injection are not current public credential types.
 
 ## Rotation and failures
 
-Archive, update, or replace credentials through their real lifecycle actions. If an OAuth refresh or connector call fails, inspect the resulting session events and credential health; OMA does not claim that a credential is usable merely because its metadata exists.
+Use **Validate** to probe the MCP server, and **Reauthorize** to renew a refreshable OAuth connection without creating a duplicate credential. **Disconnect** archives the OMA credential immediately; it does not revoke the provider-side grant, which must be revoked with the provider when required.
+
+If an OAuth refresh or connector call fails, inspect the validation result, session events, and credential health. OMA does not claim that a credential is usable merely because its metadata exists.

package/dist/ui/managed-agents-console/index.html

@@ -22,6 +22,10 @@
 import * as VaultsData from './src/vaults-data.js';
 window.VaultsData = VaultsData;
 </script>
+<script type="module">
+import * as SessionVaultsData from './src/session-vaults-data.js';
+window.SessionVaultsData = SessionVaultsData;
+</script>
 <script type="text/babel" src="src/icons.jsx"></script>
 <script type="text/babel" src="src/tweaks-panel.jsx"></script>
 <script type="text/babel" src="src/ui.jsx"></script>

package/dist/ui/managed-agents-console/src/api.js

@@ -24,6 +24,7 @@ const ARCHIVE_SESSION_CAPABILITY = Symbol("archive-session");
 const DELETE_SESSION_CAPABILITY = Symbol("delete-session");
 const CREATE_VAULT_CAPABILITY = Symbol("create-vault");
 const CREATE_VAULT_CREDENTIAL_CAPABILITY = Symbol("create-vault-credential");
+const ARCHIVE_VAULT_CREDENTIAL_CAPABILITY = Symbol("archive-vault-credential");
 const CREATE_SKILL_CAPABILITY = Symbol("create-skill");
 const CMA_BUILTIN_TOOL_NAMES = [
   "bash",
@@ -167,6 +168,11 @@ function isAllowedWorkspaceWrite(path, method, capability) {
       method === "POST" &&
       /^\/v1\/vaults\/[^/]+\/credentials$/.test(new URL(path, "http://oma.local").pathname)
     ) ||
+    (
+      capability === ARCHIVE_VAULT_CREDENTIAL_CAPABILITY &&
+      method === "POST" &&
+      /^\/v1\/vaults\/[^/]+\/credentials\/[^/]+\/archive$/.test(new URL(path, "http://oma.local").pathname)
+    ) ||
     (capability === CREATE_SKILL_CAPABILITY && method === "POST" && path === "/v1/skills") ||
     (
       capability === ARCHIVE_AGENT_CAPABILITY &&
@@ -266,6 +272,36 @@ export function createVaultCredential(vaultId, body) {
   });
 }
 
+export function archiveVaultCredential(vaultId, credentialId) {
+  const path = `/v1/vaults/${encodeURIComponent(vaultId)}/credentials/${encodeURIComponent(credentialId)}/archive`;
+  return request(path, {
+    method: "POST",
+    capability: ARCHIVE_VAULT_CREDENTIAL_CAPABILITY,
+  });
+}
+
+export function startMcpOauthFlow(vaultId, displayName, mcpServerUrl) {
+  return request("/console/mcp-oauth/flows", {
+    method: "POST",
+    body: {
+      vault_id: vaultId,
+      ...(displayName ? { display_name: displayName } : {}),
+      mcp_server_url: mcpServerUrl,
+    },
+  });
+}
+
+export function reauthorizeMcpOauthCredential(vaultId, credentialId) {
+  return request("/console/mcp-oauth/reauthorize", {
+    method: "POST",
+    body: { vault_id: vaultId, credential_id: credentialId },
+  });
+}
+
+export function getMcpOauthFlow(flowId) {
+  return request(`/console/mcp-oauth/flows/${encodeURIComponent(flowId)}`);
+}
+
 export function listSkills() {
   return fetchCursorPages("/v1/skills");
 }
@@ -1025,6 +1061,10 @@ if (typeof window !== "undefined") {
     listVaultCredentials,
     createVault,
     createVaultCredential,
+    archiveVaultCredential,
+    startMcpOauthFlow,
+    reauthorizeMcpOauthCredential,
+    getMcpOauthFlow,
     listSkills,
     createSkill,
     listWorkspaceCredentialHealth,

package/dist/ui/managed-agents-console/src/console.css

@@ -636,7 +636,7 @@ a.dl { text-decoration:none; }
 .modal-head .x { margin-left:auto; }
 .modal-body { padding:18px 20px; display:flex; flex-direction:column; gap:16px; max-height:60vh; overflow:auto; }
 .modal-foot { display:flex; align-items:center; gap:10px; justify-content:flex-end; padding:14px 20px; border-top:1px solid var(--border); }
-.modal-foot .left { margin-right:auto; color:var(--faint); font-size:12px; }
+.modal-foot .left { min-width:0; margin-right:auto; color:var(--faint); font-size:12px; overflow-wrap:anywhere; }
 
 .form-row { display:flex; flex-direction:column; gap:7px; }
 .form-row.two { display:grid; grid-template-columns:1fr 1fr; gap:14px; }
@@ -657,6 +657,7 @@ a.dl { text-decoration:none; }
 .tool-toggle { appearance:none; font-family:inherit; display:inline-flex; align-items:center; gap:7px; padding:6px 11px; border-radius:999px; border:1px solid var(--border); background:var(--surface-2); color:var(--soft); font-size:12.5px; font-weight:500; cursor:pointer; transition:.12s; }
 .tool-toggle:hover { border-color:var(--border-2); color:var(--ink); }
 .tool-toggle.on { background:var(--accent-wash); border-color:var(--accent-line); color:var(--accent); }
+.tool-toggle:disabled { cursor:not-allowed; opacity:.45; border-color:var(--border); color:var(--faint); }
 .tool-toggle .chk { width:13px; height:13px; border-radius:4px; border:1.5px solid currentColor; opacity:.55; display:flex; align-items:center; justify-content:center; }
 .tool-toggle.on .chk { background:var(--accent); border-color:var(--accent); opacity:1; }
 .radio-set { display:flex; flex-direction:column; gap:8px; }
@@ -697,6 +698,8 @@ a.dl { text-decoration:none; }
 /* small confirm dialog */
 .modal.sm { max-width:420px; }
 .modal.sm .modal-body { gap:0; }
+.modal.sm .modal-foot { flex-wrap:wrap; }
+.modal.sm .modal-foot .left { flex:1 0 100%; margin-right:0; }
 .confirm-msg { font-size:13.5px; color:var(--soft); line-height:1.6; }
 .confirm-msg b { color:var(--ink); font-weight:600; }
 .modal-head .ic.danger { background:var(--red-wash); color:var(--red); }

package/dist/ui/managed-agents-console/src/forms.jsx

@@ -44,6 +44,7 @@ function CreateSession({ agents = AGENTS, environments = ENVIRONMENTS, vaults =
   const [title, setTitle] = useStateF('');
   const [msg, setMsg] = useStateF('');
   const [vaultIds, setVaultIds] = useStateF([]);
+  const [vaultCredentialStates, setVaultCredentialStates] = useStateF({});
   const [busy, setBusy] = useStateF(false);
   const [error, setError] = useStateF('');
   const [partial, setPartial] = useStateF(null);
@@ -53,8 +54,17 @@ function CreateSession({ agents = AGENTS, environments = ENVIRONMENTS, vaults =
   const agent = agents.find((a) => a.id === agentId);
   const usingCustom = env === '__custom';
   const finalEnv = usingCustom ? customEnv.trim() : env;
-  const valid = !!agentId && !!finalEnv && !busy;
   const live = apiMode === 'api';
+  const selectedVaultCompatibility = vaultIds.map((vaultId) => ({
+    vault: vaults.find((item) => item.id === vaultId),
+    result: window.SessionVaultsData.vaultCompatibility(agent, vaultCredentialStates[vaultId]),
+  }));
+  const incompatibleVaults = selectedVaultCompatibility.filter(({ result }) => result.status === 'incompatible');
+  const unavailableVaults = selectedVaultCompatibility.filter(({ result }) => result.status === 'error');
+  const loadingVaults = selectedVaultCompatibility.filter(({ result }) => result.status === 'loading');
+  const agentHasMcp = window.SessionVaultsData.agentMcpServerUrls(agent).length > 0;
+  const vaultsReady = !live || selectedVaultCompatibility.every(({ result }) => result.compatible);
+  const valid = !!agentId && !!finalEnv && !busy && vaultsReady;
   const initialMessageEvent = () => ({
     type: 'user.message',
     content: [{ type: 'text', text: msg.trim() }],
@@ -69,6 +79,34 @@ function CreateSession({ agents = AGENTS, environments = ENVIRONMENTS, vaults =
     created:'Just now', updated:'Just now', dur:'—', tokens:'0 / 0', resources:0,
   });
 
+  const toggleVault = async (vault) => {
+    const selected = vaultIds.includes(vault.id);
+    if (selected) {
+      setVaultIds((current) => current.filter((id) => id !== vault.id));
+      return;
+    }
+    if (live && !agentHasMcp) return;
+    setVaultIds((current) => [...current, vault.id]);
+    if (!live || vaultCredentialStates[vault.id]) return;
+    setVaultCredentialStates((current) => ({
+      ...current,
+      [vault.id]: { status:'loading', credentials:[] },
+    }));
+    try {
+      const page = await api.listVaultCredentials(vault.id);
+      setVaultCredentialStates((current) => ({
+        ...current,
+        [vault.id]: { status:'loaded', credentials:page.data },
+      }));
+    } catch (credentialError) {
+      setVaultCredentialStates((current) => ({
+        ...current,
+        [vault.id]: { status:'error', credentials:[], error:credentialError.message || 'Request failed' },
+      }));
+      if (credentialError.status === 401 && onAuthExpired) onAuthExpired();
+    }
+  };
+
   const submit = async () => {
     if (!valid) return;
     setBusy(true);
@@ -169,12 +207,27 @@ function CreateSession({ agents = AGENTS, environments = ENVIRONMENTS, vaults =
         {vaults.length === 0 ? <div className="field-hint">No active vaults in this workspace.</div>
           : <div className="seg-tools">{vaults.filter((vault) => !vault.archived_at).map((vault) => {
             const selected = vaultIds.includes(vault.id);
+            const compatibility = live && vaultCredentialStates[vault.id]
+              ? window.SessionVaultsData.vaultCompatibility(agent, vaultCredentialStates[vault.id])
+              : null;
+            const disabled = live && (!agentHasMcp || (!selected && compatibility && !compatibility.compatible));
+            const title = !agentHasMcp
+              ? 'The selected agent declares no MCP servers.'
+              : compatibility?.status === 'incompatible'
+                ? 'No active credential exactly matches this agent’s MCP server URLs.'
+                : compatibility?.status === 'error'
+                  ? 'Credential compatibility could not be verified.'
+                  : undefined;
             return <button type="button" key={vault.id} className={'tool-toggle' + (selected ? ' on' : '')} aria-pressed={selected}
-              onClick={() => setVaultIds((current) => selected ? current.filter((id) => id !== vault.id) : [...current, vault.id])}>
+              disabled={disabled} title={title} onClick={() => toggleVault(vault)}>
               <span className="chk">{selected && <Icon name="checkCircle" size={9} />}</span><span>{vault.display_name}</span>
             </button>;
           })}</div>}
       </Labeled>
+      {live && vaults.length > 0 && !agentHasMcp && <div className="inline-warn" role="status"><Icon name="alert" size={14} /><span>The selected agent declares no MCP servers. Choose an MCP-enabled agent before attaching a credential vault.</span></div>}
+      {live && loadingVaults.length > 0 && <div className="inline-note" role="status"><Icon name="info" size={14} /><span>Checking whether the selected vault contains a credential matching this agent’s MCP server URLs…</span></div>}
+      {live && incompatibleVaults.length > 0 && <div className="inline-warn" role="alert"><Icon name="alert" size={14} /><span>{incompatibleVaults.map(({ vault }) => vault?.display_name || vault?.id).join(', ')} has no active credential whose server URL exactly matches this agent. Choose a compatible vault or update the agent’s MCP server URL.</span></div>}
+      {live && unavailableVaults.length > 0 && <div className="inline-warn" role="alert"><Icon name="alert" size={14} /><span>Could not verify credentials in {unavailableVaults.map(({ vault }) => vault?.display_name || vault?.id).join(', ')}. Remove the vault or retry after reconnecting the workspace.</span></div>}
 
       <Labeled label="Title" htmlFor="create-session-title" opt hint="Defaults to the first message if left blank.">
         <input id="create-session-title" name="title" className="input" placeholder="e.g. Ship your first Managed Agent" value={title} onChange={(e) => setTitle(e.target.value)} />
@@ -213,35 +266,45 @@ function CreateVaultModal({ onClose, onCreated, onAuthExpired, apiMode = 'demo',
 
 function CreateVaultCredentialModal({ vault, onClose, onCreated, onAuthExpired, apiMode = 'demo', api = window.OmaConsoleApi }) {
   const [displayName, setDisplayName] = useStateF('');
-  const [type, setType] = useStateF('static_bearer');
+  const [type, setType] = useStateF('mcp_oauth');
   const [serverUrl, setServerUrl] = useStateF('');
   const [token, setToken] = useStateF('');
-  const [expiresAt, setExpiresAt] = useStateF('');
   const [busy, setBusy] = useStateF(false);
   const [error, setError] = useStateF('');
-  const valid = /^https?:\/\//.test(serverUrl.trim()) && token.trim().length >= 8 && !busy;
+  const validUrl = /^https?:\/\//.test(serverUrl.trim());
+  const valid = validUrl && (type === 'mcp_oauth' || token.trim().length >= 8) && !busy;
   const submit = async () => {
     if (!valid) return;
     setBusy(true); setError('');
-    const auth = type === 'static_bearer'
-      ? { type, mcp_server_url:serverUrl.trim(), token:token.trim() }
-      : { type, mcp_server_url:serverUrl.trim(), access_token:token.trim(), ...(expiresAt.trim() ? { expires_at:expiresAt.trim() } : {}) };
     try {
+      if (type === 'mcp_oauth') {
+        if (apiMode !== 'api') {
+          onCreated({ id:`vcrd_demo_${Date.now()}`, vault_id:vault.id, display_name:displayName.trim() || null, auth:{ type, mcp_server_url:serverUrl.trim() } });
+          return;
+        }
+        const status = await runMcpOauthPopup(
+          () => api.startMcpOauthFlow(vault.id, displayName.trim(), serverUrl.trim()),
+          api,
+        );
+        onCreated({ id:status.credential_id, vault_id:vault.id });
+        return;
+      }
+      const auth = { type, mcp_server_url:serverUrl.trim(), token:token.trim() };
       if (apiMode !== 'api') { onCreated({ id:`vcrd_demo_${Date.now()}`, vault_id:vault.id, display_name:displayName.trim() || null, auth }); return; }
       onCreated(await api.createVaultCredential(vault.id, { ...(displayName.trim() ? { display_name:displayName.trim() } : {}), auth }));
     } catch (createError) {
-      setError(createError.message || 'Credential creation failed.');
+      setError(createError.message || 'Credential connection failed.');
       if (createError.status === 401 && onAuthExpired) onAuthExpired();
     } finally { setBusy(false); }
   };
-  return <Modal icon="database" title="Add credential" sub={`Write-only credential for ${vault.display_name || vault.displayName}.`} onClose={onClose}
-    footer={<><span className="left">Sends to <span className="mono">POST /v1/vaults/:id/credentials</span></span><button className="btn" onClick={onClose}>Cancel</button><button className="btn btn-primary" disabled={!valid} onClick={submit}>{busy ? 'Saving…' : 'Save credential'}</button></>}>
+  const endpoint = type === 'mcp_oauth' ? 'POST /console/mcp-oauth/flows' : 'POST /v1/vaults/:id/credentials';
+  return <Modal icon="database" title="Add credential" sub={`Authorize an MCP server for ${vault.display_name || vault.displayName}.`} onClose={onClose}
+    footer={<><span className="left">Sends to <span className="mono">{endpoint}</span></span><button className="btn" onClick={onClose}>Cancel</button><button className="btn btn-primary" disabled={!valid} onClick={submit}>{busy ? (type === 'mcp_oauth' ? 'Connecting…' : 'Saving…') : (type === 'mcp_oauth' ? 'Connect' : 'Save credential')}</button></>}>
     <Labeled label="Credential name" htmlFor="credential-name" opt><input id="credential-name" className="input" value={displayName} onChange={(event) => setDisplayName(event.target.value)} /></Labeled>
-    <Labeled label="Credential type" htmlFor="credential-type"><select id="credential-type" className="selectbox" value={type} onChange={(event) => setType(event.target.value)}><option value="static_bearer">Static bearer token</option><option value="mcp_oauth">MCP OAuth access token</option></select></Labeled>
-    <Labeled label="MCP server URL" htmlFor="credential-server-url" hint="This must exactly match the URL configured on the agent."><input id="credential-server-url" className="input mono" placeholder="https://mcp.example.com/mcp" value={serverUrl} onChange={(event) => setServerUrl(event.target.value)} /></Labeled>
-    <Labeled label={type === 'static_bearer' ? 'Bearer token' : 'OAuth access token'} htmlFor="credential-token" hint="Write-only. OMA never returns or renders this value after it is submitted."><input id="credential-token" type="password" className="input mono" autoComplete="off" value={token} onChange={(event) => setToken(event.target.value)} /></Labeled>
-    {type === 'mcp_oauth' && <Labeled label="Expires at" htmlFor="credential-expires" opt hint="ISO-8601 timestamp. Leave blank only for a non-expiring access token."><input id="credential-expires" className="input mono" placeholder="2027-01-01T00:00:00Z" value={expiresAt} onChange={(event) => setExpiresAt(event.target.value)} /></Labeled>}
-    {type === 'mcp_oauth' && <div className="field-hint">Use the API for OAuth refresh-token and client-secret configuration; this initial console path safely supports access-token credentials and validation.</div>}
+    <Labeled label="Credential type" htmlFor="credential-type"><select id="credential-type" className="selectbox" value={type} onChange={(event) => setType(event.target.value)}><option value="mcp_oauth">Connect with OAuth</option><option value="static_bearer">Static bearer token</option></select></Labeled>
+    <Labeled label="MCP server URL" htmlFor="credential-server-url" hint="Use the URL configured on the agent, for example https://mcp.notion.com/mcp."><input id="credential-server-url" className="input mono" placeholder="https://mcp.example.com/mcp" value={serverUrl} onChange={(event) => setServerUrl(event.target.value)} /></Labeled>
+    {type === 'static_bearer' && <Labeled label="Bearer token" htmlFor="credential-token" hint="Write-only. OMA never returns or renders this value after it is submitted."><input id="credential-token" type="password" className="input mono" autoComplete="off" value={token} onChange={(event) => setToken(event.target.value)} /></Labeled>}
+    {type === 'mcp_oauth' && <div className="field-hint">Connect opens the provider in a new window. OMA stores the resulting credential and refreshes it automatically; the browser never receives an access or refresh token.</div>}
     {error && <div className="inline-warn" role="alert"><Icon name="alert" size={14} /><span>{error}</span></div>}
   </Modal>;
 }

package/dist/ui/managed-agents-console/src/session-vaults-data.js

@@ -0,0 +1,40 @@
+export function agentMcpServerUrls(agent) {
+  return uniqueStrings(
+    (Array.isArray(agent?.mcpServers) ? agent.mcpServers : [])
+      .map((server) => server?.url),
+  );
+}
+
+export function credentialMcpServerUrls(credentials) {
+  return uniqueStrings(
+    (Array.isArray(credentials) ? credentials : [])
+      .filter((credential) => !credential?.archived_at)
+      .map((credential) => credential?.auth?.mcp_server_url),
+  );
+}
+
+export function vaultCompatibility(agent, credentialState) {
+  const agentUrls = agentMcpServerUrls(agent);
+  if (agentUrls.length === 0) {
+    return { status:"agent_without_mcp", compatible:false, agentUrls, credentialUrls:[] };
+  }
+  if (!credentialState || credentialState.status === "loading") {
+    return { status:"loading", compatible:false, agentUrls, credentialUrls:[] };
+  }
+  if (credentialState.status === "error") {
+    return { status:"error", compatible:false, agentUrls, credentialUrls:[] };
+  }
+  const credentialUrls = credentialMcpServerUrls(credentialState.credentials);
+  const matchingUrls = credentialUrls.filter((url) => agentUrls.includes(url));
+  return {
+    status: matchingUrls.length > 0 ? "compatible" : "incompatible",
+    compatible: matchingUrls.length > 0,
+    agentUrls,
+    credentialUrls,
+    matchingUrls,
+  };
+}
+
+function uniqueStrings(values) {
+  return [...new Set(values.filter((value) => typeof value === "string" && value.length > 0))];
+}

package/dist/ui/managed-agents-console/src/vaults.jsx

@@ -3,6 +3,45 @@ const { useState: useVaultState, useEffect: useVaultEffect, useRef: useVaultRef
 const DEMO_VAULTS = [{ id: 'vlt_demo', display_name: 'Demo integrations', created_at: '2026-07-01T00:00:00Z', archived_at: null }];
 const DEMO_CREDENTIALS = [{ id: 'vcrd_demo', display_name: 'Demo MCP OAuth', archived_at: null, auth: { type: 'mcp_oauth', mcp_server_url: 'https://mcp.example.test/mcp', expires_at: '2026-12-01T00:00:00Z', refresh: { token_endpoint: 'https://auth.example.test/token', scope: 'read', token_endpoint_auth: { type: 'none' } } } }];
 
+async function runMcpOauthPopup(startFlow, api = window.OmaConsoleApi) {
+  const popup = window.open('', 'oma-mcp-oauth', 'popup,width=720,height=760');
+  if (!popup) throw new Error('The authorization window was blocked. Allow popups for this console and try again.');
+  let flowId = null;
+  let wakePoll = null;
+  const onMessage = (event) => {
+    if (event.origin !== window.location.origin || event.data?.type !== 'oma:mcp-oauth') return;
+    if (flowId !== null && event.data.flowId !== flowId) return;
+    wakePoll?.();
+  };
+  window.addEventListener('message', onMessage);
+  try {
+    const started = await startFlow();
+    flowId = started.flow_id;
+    popup.location.replace(started.authorization_url);
+    const expiresAt = Date.parse(started.expires_at);
+    while (Date.now() < expiresAt) {
+      const status = await api.getMcpOauthFlow(started.flow_id);
+      if (status.status === 'connected') { popup.close(); return status; }
+      if (status.status === 'failed' || status.status === 'expired') {
+        popup.close();
+        throw new Error(status.error?.message || 'The provider did not complete authorization.');
+      }
+      if (popup.closed) throw new Error('The authorization window was closed before the connection completed.');
+      await new Promise((resolve) => {
+        const timer = setTimeout(resolve, 750);
+        wakePoll = () => { clearTimeout(timer); resolve(); };
+      });
+      wakePoll = null;
+    }
+    throw new Error('The authorization window expired. Start Connect again.');
+  } catch (error) {
+    popup.close();
+    throw error;
+  } finally {
+    window.removeEventListener('message', onMessage);
+  }
+}
+
 function ToneBadge({ tone, children }) {
   return <span className={'badge ' + VaultsData.toneBadgeClass(tone)}><i className="dot" />{children}</span>;
 }
@@ -17,12 +56,14 @@ function VaultsView({ mode, initialVaultId, onCreate, onCreateCredential, readOn
   const [confirm, setConfirm] = useVaultState(null);
   const [validation, setValidation] = useVaultState(null);
   const [validating, setValidating] = useVaultState(false);
+  const [oauthBusy, setOauthBusy] = useVaultState(null);
+  const [oauthNotice, setOauthNotice] = useVaultState(null);
   const epoch = useVaultRef(0);
   const selectedId = selected?.id || null;
 
   const refresh = () => {
     const current = ++epoch.current;
-    setError(null); setVaults(null); setSelected(null); setCredentials(null); setWarning(null);
+    setError(null); setVaults(null); setSelected(null); setCredentials(null); setWarning(null); setOauthNotice(null);
     if (mode !== 'api') { setVaults(DEMO_VAULTS.map(VaultsData.vaultRow)); return; }
     OmaConsoleApi.listVaults().then((page) => {
       if (current !== epoch.current) return;
@@ -38,7 +79,7 @@ function VaultsView({ mode, initialVaultId, onCreate, onCreateCredential, readOn
   selectedRef.current = selectedId;
   const open = (vault) => {
     const current = ++epoch.current;
-    selectedRef.current = vault.id; setSelected(vault); setCredentials(null); setDetailError(null); setValidation(null); setValidating(false); setWarning(null);
+    selectedRef.current = vault.id; setSelected(vault); setCredentials(null); setDetailError(null); setValidation(null); setValidating(false); setOauthBusy(null); setOauthNotice(null); setWarning(null);
     if (mode !== 'api') { setCredentials(DEMO_CREDENTIALS.map(VaultsData.credentialRow)); return; }
     OmaConsoleApi.listVaultCredentials(vault.id).then((page) => {
       if (!VaultsData.isCurrentVaultResult(current, epoch.current, vault.id, selectedRef.current)) return;
@@ -46,7 +87,7 @@ function VaultsView({ mode, initialVaultId, onCreate, onCreateCredential, readOn
       if (page.truncated) setWarning(VaultsData.truncationWarning('credentials'));
     }).catch((err) => { if (VaultsData.isCurrentVaultResult(current, epoch.current, vault.id, selectedRef.current)) setDetailError(err); });
   };
-  const back = () => { ++epoch.current; setSelected(null); setCredentials(null); setValidation(null); setValidating(false); setWarning(null); onBackToVaults(); };
+  const back = () => { ++epoch.current; setSelected(null); setCredentials(null); setValidation(null); setValidating(false); setOauthBusy(null); setOauthNotice(null); setWarning(null); onBackToVaults(); };
   const validate = (credential) => {
     // Guard the result the same way the list/detail fetches are guarded: a
     // probe can take seconds, and the operator can navigate to another vault
@@ -61,6 +102,49 @@ function VaultsView({ mode, initialVaultId, onCreate, onCreateCredential, readOn
       .catch((err) => { if (isCurrent()) setValidation({ error: err.message }); })
       .finally(() => { if (isCurrent()) setValidating(false); });
   };
+  const reauthorize = async (credential) => {
+    const startedEpoch = epoch.current;
+    const vaultId = selected.id;
+    const isCurrent = () => VaultsData.isCurrentVaultResult(startedEpoch, epoch.current, vaultId, selectedRef.current);
+    setOauthBusy(credential.id); setOauthNotice(null);
+    try {
+      if (mode === 'demo') {
+        setOauthNotice({ tone:'ok', message:'Demo OAuth connection renewed.' });
+        return;
+      }
+      await runMcpOauthPopup(
+        () => OmaConsoleApi.reauthorizeMcpOauthCredential(vaultId, credential.id),
+      );
+      const page = await OmaConsoleApi.listVaultCredentials(vaultId);
+      if (isCurrent()) {
+        setCredentials(page.data.map(VaultsData.credentialRow));
+        setOauthNotice({ tone:'ok', message:'OAuth connection renewed. Automatic refresh remains enabled.' });
+      }
+    } catch (err) {
+      if (isCurrent()) setOauthNotice({ tone:'error', message:err.message || 'Reauthorization failed.' });
+    } finally {
+      if (isCurrent()) setOauthBusy(null);
+    }
+  };
+  const disconnect = async (credential) => {
+    const startedEpoch = epoch.current;
+    const vaultId = selected.id;
+    const isCurrent = () => VaultsData.isCurrentVaultResult(startedEpoch, epoch.current, vaultId, selectedRef.current);
+    setConfirm(null); setOauthBusy(credential.id); setOauthNotice(null);
+    try {
+      if (mode === 'demo') {
+        if (isCurrent()) setCredentials((rows) => rows.map((row) => row.id === credential.id ? { ...row, archivedAt:new Date().toISOString() } : row));
+      } else {
+        const archived = VaultsData.credentialRow(await OmaConsoleApi.archiveVaultCredential(vaultId, credential.id));
+        if (isCurrent()) setCredentials((rows) => rows.map((row) => row.id === credential.id ? archived : row));
+      }
+      if (isCurrent()) setOauthNotice({ tone:'neutral', message:'Credential disconnected and archived. Existing sessions can no longer use it.' });
+    } catch (err) {
+      if (isCurrent()) setOauthNotice({ tone:'error', message:err.message || 'Disconnect failed.' });
+    } finally {
+      if (isCurrent()) setOauthBusy(null);
+    }
+  };
   useVaultEffect(() => {
     if (!initialVaultId || !vaults || selected) return;
     const vault = vaults.find((item) => item.id === initialVaultId);
@@ -70,7 +154,9 @@ function VaultsView({ mode, initialVaultId, onCreate, onCreateCredential, readOn
   const body = selected
     ? <VaultDetail vault={selected} credentials={credentials} error={detailError} warning={warning}
         onBack={back} onRetry={() => open(selected)}
-        mode={mode} readOnly={readOnly} onCreateCredential={() => onCreateCredential(selected)} validating={validating} validation={validation} onValidate={(credential) => setConfirm(credential)} />
+        mode={mode} readOnly={readOnly} onCreateCredential={() => onCreateCredential(selected)} validating={validating} validation={validation}
+        oauthBusy={oauthBusy} oauthNotice={oauthNotice} onValidate={(credential) => setConfirm({ kind:'validate', credential })}
+        onReauthorize={reauthorize} onDisconnect={(credential) => setConfirm({ kind:'disconnect', credential })} />
     : <div className="main-scroll scroll fade-in">
         <PageHead title="Vaults" sub="Manage workspace vaults and validate MCP OAuth credentials."
           action="Create vault" onAction={onCreate} readOnly={readOnly} endpoint="POST /v1/vaults" />
@@ -92,14 +178,18 @@ function VaultsView({ mode, initialVaultId, onCreate, onCreateCredential, readOn
   // made Validate a no-op once a vault was open).
   return <>
     {body}
-    {confirm && <ConfirmDialog icon="alert" title="Validate credential"
+    {confirm?.kind === 'validate' && <ConfirmDialog icon="alert" title="Validate credential"
       message="Validate contacts the MCP server with this credential and may refresh the token at the provider."
       confirmLabel="Validate" endpoint="POST /v1/vaults/:id/credentials/:id/mcp_oauth_validate"
-      onClose={() => setConfirm(null)} onConfirm={() => validate(confirm)} />}
+      onClose={() => setConfirm(null)} onConfirm={() => validate(confirm.credential)} />}
+    {confirm?.kind === 'disconnect' && <ConfirmDialog icon="archive" danger title="Disconnect credential"
+      message="Archive this credential? Existing sessions will no longer be able to use it. Provider-side authorization is not revoked."
+      confirmLabel="Disconnect" endpoint="POST /v1/vaults/:id/credentials/:id/archive"
+      onClose={() => setConfirm(null)} onConfirm={() => disconnect(confirm.credential)} />}
   </>;
 }
 
-function VaultDetail({ vault, credentials, error, warning, onBack, onRetry, mode, readOnly, onCreateCredential, validating, validation, onValidate }) {
+function VaultDetail({ vault, credentials, error, warning, onBack, onRetry, mode, readOnly, onCreateCredential, validating, validation, onValidate, oauthBusy, oauthNotice, onReauthorize, onDisconnect }) {
   return <div className="main-scroll scroll fade-in"><PageHead title={vault.displayName} sub={vault.id} />
     <div className="toolbar"><button className="btn" onClick={onBack}>Back to vaults</button>{!readOnly && <button className="btn btn-primary" onClick={onCreateCredential}><Icon name="plus" size={15} />Add credential</button>}</div>
     {warning && <div className="inline-warn"><Icon name="alert" size={14} /><span>{warning}</span></div>}
@@ -111,8 +201,13 @@ function VaultDetail({ vault, credentials, error, warning, onBack, onRetry, mode
         <div style={{ display:'flex', gap:12, alignItems:'center' }}><span className="mono" style={{ color:'var(--soft)' }}>{c.id}</span><b>{c.displayName}</b><span className="pill">{c.authType}</span>{c.archivedAt && <St k="archived" />}</div>
         <div className="field-hint" style={{ marginTop:6 }}>{c.serverUrl || 'No server URL'} · expires {VaultsData.relativeTime(c.expiresAt)}</div>
         {c.refresh && <div className="field-hint">token host {c.refresh.tokenEndpointHost} · {c.refresh.scope || 'no scope'} · {c.refresh.endpointAuth || 'no endpoint auth'}</div>}
-        {mode !== 'mock' && !c.archivedAt && c.authType === 'mcp_oauth' && <button className="btn" disabled={validating} onClick={() => onValidate(c)} style={{ marginTop:8 }}>{validating ? 'Validating…' : 'Validate'}</button>}
+        {mode !== 'mock' && !c.archivedAt && c.authType === 'mcp_oauth' && <div style={{ display:'flex', gap:8, marginTop:8 }}>
+          <button className="btn" disabled={validating || oauthBusy === c.id} onClick={() => onValidate(c)}>{validating ? 'Validating…' : 'Validate'}</button>
+          {c.refresh && <button className="btn" disabled={oauthBusy === c.id} onClick={() => onReauthorize(c)}>{oauthBusy === c.id ? 'Connecting…' : 'Reauthorize'}</button>}
+          <button className="btn btn-danger" disabled={oauthBusy === c.id || readOnly} onClick={() => onDisconnect(c)}>Disconnect</button>
+        </div>}
       </div>)}</div>}
+    {oauthNotice && <div className={oauthNotice.tone === 'error' ? 'inline-warn' : 'panel'} role="status" style={{ marginTop:12, padding:14 }}><span>{oauthNotice.message}</span></div>}
     {validation && <ValidationResult value={validation} />}
   </div>;
 }
@@ -168,4 +263,4 @@ function CredentialHealthView({ workspaceId, onBack, onReauth }) {
   </div>;
 }
 
-Object.assign(window, { VaultsView, CredentialHealthView, VaultsData: window.VaultsData || {} });
+Object.assign(window, { VaultsView, CredentialHealthView, runMcpOauthPopup, VaultsData: window.VaultsData || {} });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "open-managed-agents",
-  "version": "0.1.2",
+  "version": "0.2.0",
   "description": "Self-hostable implementation of Anthropic's Managed Agents API surface.",
   "repository": {
     "type": "git",
@@ -38,15 +38,15 @@
   },
   "dependencies": {
     "@clack/prompts": "1.7.0",
-    "@earendil-works/pi-coding-agent": "0.80.6",
-    "@hono/node-server": "2.0.0",
-    "@modelcontextprotocol/sdk": "1.29.0",
-    "hono": "4.12.29",
+    "@earendil-works/pi-coding-agent": "0.85.1",
+    "@hono/node-server": "2.1.1",
+    "@modelcontextprotocol/sdk": "1.31.0",
+    "hono": "4.13.7",
     "node-forge": "1.4.0",
     "picocolors": "1.1.1",
     "proper-lockfile": "4.1.2",
     "typebox": "1.1.29",
-    "undici": "7.28.0",
+    "undici": "7.29.1",
     "yauzl": "3.4.0"
   },
   "devDependencies": {
@@ -59,6 +59,6 @@
     "playwright-core": "1.61.1",
     "tsx": "4.21.0",
     "typescript": "6.0.3",
-    "vitest": "4.1.5"
+    "vitest": "4.1.11"
   }
 }