kolega-code 0.35.1__tar.gz → 0.36.0__tar.gz

{kolega_code-0.35.1 → kolega_code-0.36.0}/CHANGELOG.md

@@ -6,6 +6,33 @@ This project uses GitHub Releases for detailed generated release notes. This fil
 
 ## Unreleased
 
+## 0.36.0 - 2026-09-07
+
+### Added
+
+- **GPT-6 Astra.** OpenAI's new flagship model is available on both the API
+  and ChatGPT-subscription providers: 1M-token context with 128K output,
+  vision, hosted web search, `codex_apply_patch` editing, and
+  `low`–`max` reasoning effort levels (default `medium`). The
+  ChatGPT-subscription route keeps the conservative 400K input budget until
+  Astra's larger window is verified on the Codex backend.
+- **Pre-registered OAuth credentials for remote MCP servers.** Servers that
+  don't implement Dynamic Client Registration (HubSpot, Slack, GitHub
+  Copilot, enterprise IdPs) can now be connected with a pre-registered
+  client: new `--oauth-client-id`, `--oauth-client-secret`,
+  `--oauth-client-secret-env`, and `--oauth-auth-method` flags on
+  `kolega-code mcp add`, matching OAuth controls on the MCP page in TUI
+  settings, preserved explicit redirect ports/hosts, actionable diagnostics
+  when registration fails, and PBKDF2-salted OAuth cache fingerprints with
+  refresh tokens preserved across reconnects.
+
+### Fixed
+
+- **Gateway (Telegram):** the typing indicator now stays alive for the whole
+  turn. Telegram expires typing actions after ~5 seconds, so it previously
+  vanished during exactly the stretches where feedback matters — model
+  thinking before the first chunk and long-running tool calls.
+
 ## 0.35.1 - 2026-09-03
 
 ### Fixed

{kolega_code-0.35.1 → kolega_code-0.36.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: kolega-code
-Version: 0.35.1
+Version: 0.36.0
 Summary: Multi-agent coding in the terminal
 Project-URL: Homepage, https://kolega-ai.github.io/kolega-code/
 Project-URL: Documentation, https://kolega-ai.github.io/kolega-code/

{kolega_code-0.35.1 → kolega_code-0.36.0}/kolega_code/__init__.py

@@ -174,4 +174,4 @@ __all__ = [
     "parse_git_status_output",
 ]
 
-__version__ = "0.35.1"
+__version__ = "0.36.0"

{kolega_code-0.35.1 → kolega_code-0.36.0}/kolega_code/agent/__init__.py

@@ -51,4 +51,4 @@ __all__ = [
     "ToolExtension",
 ]
 
-__version__ = "0.35.1"
+__version__ = "0.36.0"

{kolega_code-0.35.1 → kolega_code-0.36.0}/kolega_code/cli/main.py

@@ -796,6 +796,14 @@ def _build_subcommand_parser() -> argparse.ArgumentParser:
     add.add_argument("--env", action="append", default=[], help="Environment variable as NAME=VALUE (repeatable).")
     add.add_argument("--cwd", help="Working directory for stdio command; relative paths resolve under project.")
     add.add_argument("--oauth", action="store_true", help="Enable OAuth for this HTTP MCP server.")
+    add.add_argument("--oauth-client-id", help="Pre-registered OAuth client ID.")
+    add.add_argument("--oauth-client-secret", help="Pre-registered OAuth client secret.")
+    add.add_argument("--oauth-client-secret-env", help="Environment variable name holding the OAuth client secret.")
+    add.add_argument(
+        "--oauth-auth-method",
+        choices=["client_secret_post", "client_secret_basic", "none"],
+        help="Token endpoint authentication method.",
+    )
     add.add_argument("--oauth-scope", help="OAuth scopes to request.")
     add.add_argument("--redirect-uri", help="OAuth redirect URI; defaults to an ephemeral localhost callback.")
     add.add_argument("--disabled", action="store_true", help="Add the server disabled.")
@@ -2697,6 +2705,12 @@ def _mcp_mutation_target(args: argparse.Namespace, project_path: Path, state_dir
 def _server_config_from_add_args(args: argparse.Namespace) -> MCPServerConfig:
     headers = _parse_key_value_options(getattr(args, "header", []) or [], "--header")
     env = _parse_key_value_options(getattr(args, "env", []) or [], "--env")
+    oauth_client_id = getattr(args, "oauth_client_id", None)
+    oauth_client_secret = getattr(args, "oauth_client_secret", None)
+    oauth_client_secret_env = getattr(args, "oauth_client_secret_env", None)
+    oauth_auth_method = getattr(args, "oauth_auth_method", None)
+    oauth_enabled = bool(args.oauth) or bool(oauth_client_id or oauth_client_secret or oauth_client_secret_env)
+
     payload: dict[str, Any] = {
         "id": args.server_id,
         "name": args.name,
@@ -2709,9 +2723,13 @@ def _server_config_from_add_args(args: argparse.Namespace) -> MCPServerConfig:
         "env": env,
         "cwd": args.cwd,
         "oauth": {
-            "enabled": bool(args.oauth),
+            "enabled": oauth_enabled,
             "scope": args.oauth_scope,
             "redirect_uri": args.redirect_uri,
+            "client_id": oauth_client_id,
+            "client_secret": oauth_client_secret,
+            "client_secret_env": oauth_client_secret_env,
+            "token_endpoint_auth_method": oauth_auth_method,
         },
     }
     return MCPServerConfig.model_validate(payload)

{kolega_code-0.35.1 → kolega_code-0.36.0}/kolega_code/cli/provider_registry.py

@@ -90,6 +90,7 @@ MODEL_LABELS: dict[str, str] = {
     "claude-opus-4-5-20251101": "Claude Opus 4.5",
     "claude-haiku-4-5-20251001": "Claude Haiku 4.5",
     # OpenAI (shared labels across the API and ChatGPT-subscription providers)
+    "gpt-6-astra": "GPT-6 Astra",
     "gpt-5.6-sol": "GPT-5.6 Sol",
     "gpt-5.6-terra": "GPT-5.6 Terra",
     "gpt-5.6-luna": "GPT-5.6 Luna",

{kolega_code-0.35.1 → kolega_code-0.36.0}/kolega_code/cli/tui/settings_panel.py

@@ -104,6 +104,12 @@ MCP_TRANSPORT_OPTIONS = [
     ("stdio command", "stdio"),
 ]
 MCP_ENABLED_OPTIONS = [("Enabled", "true"), ("Disabled", "false")]
+MCP_OAUTH_AUTH_METHOD_OPTIONS = [
+    ("Auto (POST if secret, none if public)", "auto"),
+    ("client_secret_post", "client_secret_post"),
+    ("client_secret_basic", "client_secret_basic"),
+    ("none (public client / PKCE)", "none"),
+]
 MCP_STATUS_MESSAGE_MAX = 96
 MCP_STATUS_NAME_MAX = 34
 # Compression threshold select: "default" maps to None (the agent's built-in 95%).
@@ -417,6 +423,16 @@ class SettingsPanelMixin(tui_app_base.KolegaAppBase):
             self._update_mcp_transport_fields(str(event.value))
             return
 
+        if select_id == "mcp_oauth_select":
+            transport = "streamable_http"
+            try:
+                transport = str(self._settings_query_one("#mcp_transport_select", Select).value)
+            except NoMatches:
+                pass
+            http = transport in {"streamable_http", "sse"}
+            self._update_mcp_oauth_fields(http and str(event.value) == "true")
+            return
+
         row = _row_for_widget(select_id)
         if row is not None and select_id == row.provider_id:
             provider = str(event.value)
@@ -1477,6 +1493,12 @@ class SettingsPanelMixin(tui_app_base.KolegaAppBase):
             set_input("mcp_url_input", "")
             set_input("mcp_headers_input", "")
             set_select("mcp_oauth_select", "false")
+            set_input("mcp_oauth_client_id_input", "")
+            set_input("mcp_oauth_client_secret_input", "")
+            set_input("mcp_oauth_client_secret_env_input", "")
+            set_input("mcp_oauth_redirect_uri_input", "")
+            set_input("mcp_oauth_scope_input", "")
+            set_select("mcp_oauth_auth_method_select", "auto")
             set_input("mcp_command_input", "")
             set_input("mcp_args_input", "")
             set_input("mcp_env_input", "")
@@ -1491,6 +1513,12 @@ class SettingsPanelMixin(tui_app_base.KolegaAppBase):
         set_input("mcp_url_input", server.url or "")
         set_input("mcp_headers_input", json.dumps(server.headers, sort_keys=True) if server.headers else "")
         set_select("mcp_oauth_select", "true" if server.oauth.enabled else "false")
+        set_input("mcp_oauth_client_id_input", server.oauth.client_id or "")
+        set_input("mcp_oauth_client_secret_input", server.oauth.client_secret or "")
+        set_input("mcp_oauth_client_secret_env_input", server.oauth.client_secret_env or "")
+        set_input("mcp_oauth_redirect_uri_input", server.oauth.redirect_uri or "")
+        set_input("mcp_oauth_scope_input", server.oauth.scope or "")
+        set_select("mcp_oauth_auth_method_select", server.oauth.token_endpoint_auth_method or "auto")
         set_input("mcp_command_input", server.command or "")
         set_input("mcp_args_input", " ".join(shlex.quote(arg) for arg in server.args))
         set_input("mcp_env_input", json.dumps(server.env, sort_keys=True) if server.env else "")
@@ -1503,6 +1531,26 @@ class SettingsPanelMixin(tui_app_base.KolegaAppBase):
             self._set_mcp_source_hint("This server is stored in your global MCP config.")
         self._update_mcp_transport_fields(server.transport)
 
+    def _update_mcp_oauth_fields(self, visible: bool) -> None:
+        for widget_id in (
+            "mcp_oauth_client_id_label",
+            "mcp_oauth_client_id_input",
+            "mcp_oauth_client_secret_label",
+            "mcp_oauth_client_secret_input",
+            "mcp_oauth_client_secret_env_label",
+            "mcp_oauth_client_secret_env_input",
+            "mcp_oauth_redirect_uri_label",
+            "mcp_oauth_redirect_uri_input",
+            "mcp_oauth_scope_label",
+            "mcp_oauth_scope_input",
+            "mcp_oauth_auth_method_label",
+            "mcp_oauth_auth_method_select",
+        ):
+            try:
+                self._settings_query_one(f"#{widget_id}").display = visible
+            except NoMatches:
+                pass
+
     def _update_mcp_transport_fields(self, transport: str) -> None:
         http = transport in {"streamable_http", "sse"}
         for widget_id, visible in (
@@ -1525,6 +1573,12 @@ class SettingsPanelMixin(tui_app_base.KolegaAppBase):
                 self._settings_query_one(f"#{widget_id}").display = visible
             except NoMatches:
                 pass
+        oauth_enabled = False
+        try:
+            oauth_enabled = http and str(self._settings_query_one("#mcp_oauth_select", Select).value) == "true"
+        except NoMatches:
+            pass
+        self._update_mcp_oauth_fields(oauth_enabled)
         try:
             url_input = self._settings_query_one("#mcp_url_input", Input)
             if transport == "streamable_http":
@@ -1621,7 +1675,8 @@ class SettingsPanelMixin(tui_app_base.KolegaAppBase):
         enabled = str(self._settings_query_one("#mcp_enabled_select", Select).value) == "true"
         url = self._settings_query_one("#mcp_url_input", Input).value.strip() or None
         headers_text = self._settings_query_one("#mcp_headers_input", Input).value.strip()
-        oauth_enabled = str(self._settings_query_one("#mcp_oauth_select", Select).value) == "true"
+        http = transport in {"streamable_http", "sse"}
+        oauth_enabled = http and str(self._settings_query_one("#mcp_oauth_select", Select).value) == "true"
         command = self._settings_query_one("#mcp_command_input", Input).value.strip() or None
         args_text = self._settings_query_one("#mcp_args_input", Input).value.strip()
         env_text = self._settings_query_one("#mcp_env_input", Input).value.strip()
@@ -1640,6 +1695,77 @@ class SettingsPanelMixin(tui_app_base.KolegaAppBase):
             else selected
         )
 
+        oauth_client_id = None
+        oauth_client_secret = None
+        oauth_client_secret_env = None
+        oauth_redirect_uri = None
+        oauth_scope = None
+        oauth_auth_method: Optional[Literal["client_secret_post", "client_secret_basic", "none"]] = None
+
+        if http:
+            try:
+                oauth_client_id = self._settings_query_one("#mcp_oauth_client_id_input", Input).value.strip() or None
+            except NoMatches:
+                pass
+            try:
+                oauth_client_secret = (
+                    self._settings_query_one("#mcp_oauth_client_secret_input", Input).value.strip() or None
+                )
+            except NoMatches:
+                pass
+            try:
+                oauth_client_secret_env = (
+                    self._settings_query_one("#mcp_oauth_client_secret_env_input", Input).value.strip() or None
+                )
+            except NoMatches:
+                pass
+            try:
+                oauth_redirect_uri = (
+                    self._settings_query_one("#mcp_oauth_redirect_uri_input", Input).value.strip() or None
+                )
+            except NoMatches:
+                pass
+            try:
+                oauth_scope = self._settings_query_one("#mcp_oauth_scope_input", Input).value.strip() or None
+            except NoMatches:
+                pass
+            try:
+                method_val = str(self._settings_query_one("#mcp_oauth_auth_method_select", Select).value)
+                if method_val in {"client_secret_post", "client_secret_basic", "none"}:
+                    oauth_auth_method = cast(Literal["client_secret_post", "client_secret_basic", "none"], method_val)
+            except NoMatches:
+                pass
+
+        client_name = "Kolega Code"
+        client_uri = None
+        client_metadata_url = None
+        timeout_seconds = 300.0
+        if selected != MCP_NEW_SERVER_VALUE:
+            try:
+                config = self._load_mcp_config_for_ui()
+                existing = config.servers.get(selected)
+                if existing:
+                    client_name = existing.oauth.client_name
+                    client_uri = existing.oauth.client_uri
+                    client_metadata_url = existing.oauth.client_metadata_url
+                    timeout_seconds = existing.oauth.timeout_seconds
+            except Exception:
+                pass
+
+        oauth = MCPOAuthConfig(
+            enabled=oauth_enabled,
+            client_id=oauth_client_id,
+            client_secret=oauth_client_secret,
+            client_secret_env=oauth_client_secret_env,
+            redirect_uri=oauth_redirect_uri,
+            scope=oauth_scope,
+            token_endpoint_auth_method=oauth_auth_method,
+            client_name=client_name,
+            client_uri=client_uri,
+            client_metadata_url=client_metadata_url,
+            timeout_seconds=timeout_seconds,
+        )
+
         return MCPServerConfig(
             id=server_id,
             name=name,
@@ -1647,7 +1773,7 @@ class SettingsPanelMixin(tui_app_base.KolegaAppBase):
             enabled=enabled,
             url=url,
             headers=headers,
-            oauth=MCPOAuthConfig(enabled=oauth_enabled),
+            oauth=oauth,
             command=command,
             args=args,
             env=env,

{kolega_code-0.35.1 → kolega_code-0.36.0}/kolega_code/cli/tui/settings_screen.py

@@ -588,6 +588,26 @@ class SettingsScreen(ModalScreen[None]):
                     allow_blank=False,
                     value="false",
                 )
+                yield Label("OAuth Client ID", id="mcp_oauth_client_id_label")
+                yield Input(id="mcp_oauth_client_id_input", placeholder="e.g. client_abc123")
+                yield Label("OAuth Client Secret", id="mcp_oauth_client_secret_label")
+                yield Input(id="mcp_oauth_client_secret_input", placeholder="optional direct secret", password=True)
+                yield Label("OAuth Client Secret Env Var", id="mcp_oauth_client_secret_env_label")
+                yield Input(id="mcp_oauth_client_secret_env_input", placeholder="e.g. HUBSPOT_MCP_CLIENT_SECRET")
+                yield Label("OAuth Redirect URI", id="mcp_oauth_redirect_uri_label")
+                yield Input(
+                    id="mcp_oauth_redirect_uri_input",
+                    placeholder="e.g. http://127.0.0.1:33418/callback (default: ephemeral port)",
+                )
+                yield Label("OAuth Scopes", id="mcp_oauth_scope_label")
+                yield Input(id="mcp_oauth_scope_input", placeholder="e.g. read write")
+                yield Label("OAuth Token Auth Method", id="mcp_oauth_auth_method_label")
+                yield Select(
+                    settings_panel.MCP_OAUTH_AUTH_METHOD_OPTIONS,
+                    id="mcp_oauth_auth_method_select",
+                    allow_blank=False,
+                    value="auto",
+                )
                 yield Label("Command", id="mcp_command_label")
                 yield Input(id="mcp_command_input", placeholder="npx")
                 yield Label("Arguments", id="mcp_args_label")

{kolega_code-0.35.1 → kolega_code-0.36.0}/kolega_code/gateway/bridge.py

@@ -18,7 +18,10 @@ turns:
   would surface above the latest text), and the messages persist as a trail
   of what the agent did during the turn;
 - text is chunked at the adapter's limit; the first chunk is the edited
-  message and overflow chunks are sent as continuations on finalize.
+  message and overflow chunks are sent as continuations on finalize;
+- a typing action is re-sent every few seconds for the whole turn (chat
+  platforms expire it after ~5s), so thinking and long tool runs keep
+  showing "typing…" until the reply lands.
 
 Chunk content is *incremental*, so the renderer appends and re-renders the
 accumulated text — it never replaces with the last segment.
@@ -39,6 +42,10 @@ logger = logging.getLogger(__name__)
 
 #: Cap on a round message's lines so a chatty turn cannot spam an unbounded edit.
 MAX_STATUS_LINES = 8
+#: Chat platforms expire a typing action after ~5 seconds (Telegram: "status
+#: is set for 5 seconds or less"); refresh slightly faster so the indicator
+#: never lapses while a turn is in progress.
+TYPING_REFRESH_SECONDS = 4.0
 #: Rendered status line: (icon, tool description, tool call id).
 StatusLine = tuple[str, str, str]
 
@@ -54,6 +61,7 @@ class TurnRenderer:
         event_queue: asyncio.Queue[AgentEvent],
         chunk_limit: Optional[int] = None,
         edit_throttle_seconds: float = 1.0,
+        typing_refresh_seconds: float = TYPING_REFRESH_SECONDS,
         monotonic: Any = time.monotonic,
     ) -> None:
         self._adapter = adapter
@@ -61,6 +69,7 @@ class TurnRenderer:
         self._events = event_queue
         self._chunk_limit = chunk_limit or adapter.capabilities.text_chunk_limit
         self._edit_throttle = edit_throttle_seconds
+        self._typing_refresh = typing_refresh_seconds
         self._monotonic = monotonic
         # Per-segment state, mirroring the TUI's stream fold: a segment is one
         # contiguous assistant response identified by its chunk uuid (the
@@ -92,10 +101,12 @@ class TurnRenderer:
         reply stays visible.
         """
         pump: Optional[asyncio.Task[None]] = None
+        typing: Optional[asyncio.Task[None]] = None
         if self._events is not None:
             pump = asyncio.create_task(self._event_pump(), name="gateway-turn-event-pump")
         try:
             await self._adapter.set_typing(self._chat_id, True)
+            typing = asyncio.create_task(self._typing_keepalive(), name="gateway-turn-typing")
             async for chunk in chunks:
                 if chunk.get("type") != "response":
                     # Thinking chunks stay off the wire; they are reasoning, not output.
@@ -121,14 +132,31 @@ class TurnRenderer:
             await self._finalize_segment()
             return self._total_text
         finally:
-            if pump is not None:
-                pump.cancel()
-                try:
-                    await pump
-                except asyncio.CancelledError:
-                    pass
+            for task in (pump, typing):
+                if task is not None:
+                    task.cancel()
+                    try:
+                        await task
+                    except asyncio.CancelledError:
+                        pass
             await self._adapter.set_typing(self._chat_id, False)
 
+    async def _typing_keepalive(self) -> None:
+        """Re-send the typing action so the indicator outlives its ~5s expiry.
+
+        Covers the silent stretches of a turn — model thinking before the
+        first chunk and long-running tool calls, where no message is sent or
+        edited. Refresh only (never hides: the ``False`` call is the
+        adapter's business); a failing adapter must not end the loop, since
+        typing is cosmetic.
+        """
+        while True:
+            await asyncio.sleep(self._typing_refresh)
+            try:
+                await self._adapter.set_typing(self._chat_id, True)
+            except Exception:  # noqa: BLE001 — typing indicators are cosmetic
+                logger.debug("gateway: typing refresh failed", exc_info=True)
+
     # -- Reply messages (one per response segment) -------------------------
 
     async def _finalize_segment(self) -> None:

{kolega_code-0.35.1 → kolega_code-0.36.0}/kolega_code/llm/specs/catalog/openai.py

@@ -11,6 +11,21 @@ from kolega_code.llm.specs.types import ThinkingEffortSpec
 # The ChatGPT-subscription backend (openai_chatgpt) carries the flag too,
 # verified through its own OAuth transport the same day.
 OPENAI_SPECS = {
+    ("openai", "gpt-6-astra"): {
+        "context_length": 1050000,
+        "max_completion_tokens": 128000,
+        "input_budget": "window_minus_output",
+        "default_temperature": 1.0,
+        "supports_temperature": False,
+        "supports_vision": True,
+        "supports_hosted_web_search": True,
+        "preferred_edit_protocol": "codex_apply_patch",
+        "thinking_effort": ThinkingEffortSpec(
+            options=("low", "medium", "high", "xhigh", "max"),
+            default="medium",
+            mode="openai_responses_reasoning",
+        ),
+    },
     ("openai", "gpt-5.6-sol"): {
         "context_length": 1050000,
         "max_completion_tokens": 128000,

{kolega_code-0.35.1 → kolega_code-0.36.0}/kolega_code/llm/specs/catalog/openai_chatgpt.py

@@ -13,6 +13,23 @@ from kolega_code.llm.specs.types import ThinkingEffortSpec
 # GPT-5.5, despite the API models exposing a larger window. Keep the
 # subscription-specific values here so compression runs before backend limits.
 OPENAI_CHATGPT_SPECS = {
+    ("openai_chatgpt", "gpt-6-astra"): {
+        # Retain the conservative subscription budget used by GPT-5.6 until
+        # Astra's larger input window is verified on the Codex backend.
+        "context_length": 400000,
+        "max_completion_tokens": 128000,
+        "input_budget": "window_minus_output",
+        "default_temperature": 1.0,
+        "supports_temperature": False,
+        "supports_vision": True,
+        "supports_hosted_web_search": True,
+        "preferred_edit_protocol": "codex_apply_patch",
+        "thinking_effort": ThinkingEffortSpec(
+            options=("low", "medium", "high", "xhigh", "max"),
+            default="medium",
+            mode="openai_responses_reasoning",
+        ),
+    },
     ("openai_chatgpt", "gpt-5.6-sol"): {
         "context_length": 400000,
         "max_completion_tokens": 128000,

{kolega_code-0.35.1 → kolega_code-0.36.0}/kolega_code/mcp/config.py

@@ -4,12 +4,14 @@ from __future__ import annotations
 
 import hashlib
 import json
+import os
 import re
 from dataclasses import dataclass, field
 from pathlib import Path
-from typing import Any, Literal, Optional
+from typing import Any, Literal, Mapping, Optional
+from urllib.parse import urlparse
 
-from pydantic import BaseModel, Field, ValidationError, field_validator, model_validator
+from pydantic import BaseModel, ConfigDict, Field, ValidationError, field_validator, model_validator
 
 from kolega_code.local_state import write_private_secret_text
 
@@ -22,6 +24,7 @@ _SERVER_ID_RE = re.compile(r"^[A-Za-z0-9_-]+$")
 # least 25 chars of budget for the tool id after the ``mcp__{server}__`` prefix.
 _SERVER_ID_MAX_LENGTH = 32
 _SERVER_ID_PREFIX_LENGTH = 24
+_ENV_VAR_RE = re.compile(r"^[A-Za-z_][A-Za-z0-9_]*$")
 
 
 def sanitize_mcp_server_id(value: str) -> str:
@@ -50,18 +53,78 @@ class MCPConfigError(ValueError):
 class MCPOAuthConfig(BaseModel):
     """OAuth settings for an HTTP MCP server."""
 
+    model_config = ConfigDict(hide_input_in_errors=True)
+
     enabled: bool = False
     redirect_uri: Optional[str] = None
     scope: Optional[str] = None
+    client_id: Optional[str] = None
+    client_secret: Optional[str] = None
+    client_secret_env: Optional[str] = None
+    token_endpoint_auth_method: Optional[Literal["client_secret_post", "client_secret_basic", "none"]] = None
     client_name: str = "Kolega Code"
     client_uri: Optional[str] = None
     client_metadata_url: Optional[str] = None
     timeout_seconds: float = Field(default=300.0, gt=0)
 
+    @field_validator("redirect_uri")
+    @classmethod
+    def _validate_redirect_uri(cls, value: Optional[str]) -> Optional[str]:
+        if not value:
+            return None
+        parsed = urlparse(value)
+        if parsed.scheme != "http" or parsed.hostname not in {"127.0.0.1", "localhost"}:
+            raise ValueError(
+                "MCP OAuth redirect_uri must be a localhost http URL (e.g. http://127.0.0.1:33418/callback)"
+            )
+        # Accessing port also rejects malformed and out-of-range values.
+        _ = parsed.port
+        if parsed.username is not None or parsed.password is not None or parsed.fragment:
+            raise ValueError("MCP OAuth redirect_uri must not contain credentials or a fragment")
+        return value
+
+    @field_validator("client_secret_env")
+    @classmethod
+    def _validate_client_secret_env(cls, value: Optional[str]) -> Optional[str]:
+        if not value:
+            return None
+        stripped = value.strip()
+        if not _ENV_VAR_RE.match(stripped):
+            raise ValueError("client_secret_env must be a valid environment variable name")
+        return stripped
+
+    @model_validator(mode="after")
+    def _validate_oauth_fields(self) -> "MCPOAuthConfig":
+        if (self.client_secret or self.client_secret_env) and not self.client_id:
+            raise ValueError("OAuth client_secret and client_secret_env require a client_id")
+        if self.token_endpoint_auth_method in {"client_secret_post", "client_secret_basic"}:
+            if not self.client_id or not (self.client_secret or self.client_secret_env):
+                raise ValueError("OAuth client secret authentication requires a client_id and client secret")
+        if "enabled" not in self.model_fields_set and self.client_id:
+            self.enabled = True
+        return self
+
+    def resolve_client_secret(self, env: Optional[Mapping[str, str]] = None) -> Optional[str]:
+        if self.client_secret:
+            return self.client_secret
+        if self.client_secret_env:
+            source_env = os.environ if env is None else env
+            return source_env.get(self.client_secret_env) or None
+        return None
+
+    def resolve_auth_method(self, env: Optional[Mapping[str, str]] = None) -> str:
+        if self.token_endpoint_auth_method:
+            return self.token_endpoint_auth_method
+        if self.resolve_client_secret(env=env):
+            return "client_secret_post"
+        return "none"
+
 
 class MCPServerConfig(BaseModel):
     """One configured MCP server."""
 
+    model_config = ConfigDict(hide_input_in_errors=True)
+
     id: str
     name: Optional[str] = None
     transport: Literal["streamable_http", "sse", "stdio"] = "streamable_http"
@@ -130,10 +193,15 @@ class MCPServerConfig(BaseModel):
             payload["headers"] = {key: "‹secret›" for key in payload["headers"]}
         if payload.get("env"):
             payload["env"] = {key: "‹secret›" for key in payload["env"]}
+        if payload.get("oauth") and isinstance(payload["oauth"], dict):
+            if payload["oauth"].get("client_secret"):
+                payload["oauth"]["client_secret"] = "‹secret›"
         return payload
 
 
 class MCPConfigFile(BaseModel):
+    model_config = ConfigDict(hide_input_in_errors=True)
+
     schema_version: int = MCP_CONFIG_SCHEMA_VERSION
     servers: list[MCPServerConfig] = Field(default_factory=list)
 
@@ -349,4 +417,7 @@ def mcp_secret_values(config: LoadedMCPConfig) -> list[str]:
     for server in config.servers.values():
         values.extend(value for value in server.headers.values() if value)
         values.extend(value for value in server.env.values() if value)
+        secret = server.oauth.resolve_client_secret()
+        if secret:
+            values.append(secret)
     return values