Skip to content

merge(stage): upstream 73e097b8c with MCP OAuth for outside agents - #287

Merged
bk-agent-01 merged 150 commits into
stagefrom
t3code/upstream-mcp-oauth
Oct 8, 2026
Merged

merge(stage): upstream 73e097b8c with MCP OAuth for outside agents#287
bk-agent-01 merged 150 commits into
stagefrom
t3code/upstream-mcp-oauth

Conversation

@bk-agent-01

@bk-agent-01 bk-agent-01 commented Oct 8, 2026

Copy link
Copy Markdown
Collaborator

Problem

The fork lacked upstream's new MCP work: OAuth sign-in for outside agents (Claude Code, Codex, ChatGPT, claude.ai), access declarations for each MCP tool, Copy MCP URL, and MCP apps. The fork had its own Settings-issued MCP credentials and access checks. Keeping two systems makes each upstream merge harder.

What this PR does

It merges upstream 73e097b8c (139 commits) into stage. Where upstream now does the same thing, the PR uses upstream's code. Fork changes stay as small marked layers on top.

Area Upstream code used Fork layer kept
Outside agents sign in OAuth (pingdotgg#16336, pingdotgg#16718), connect-agent page, Copy MCP URL (pingdotgg#16337, pingdotgg#16909) An OAuth client is bound to the team user who approved it.
MCP tool access McpToolAccess declarations (pingdotgg#16335) Fork tools (t3_* control tools, web UI bridge, session webhooks) use the upstream declarations. Fork-only checks stay in the handlers.
Settings-issued credentials Upstream client caller with an access level clientAccess.expbkt3.ts maps the credentials onto it, so Bifrost and Toolyard keep their access.
GitHub GitHubApi replaces GitHubCli gitHubProfileCredential.expbkt3.ts keeps one token for each profile, with its own cache key and rate-limit scope.
New RPCs mcpApps.*, terminal.observe They get the fork's per-thread access gate.
Migrations Upstream 59 and 60 Registered as 1048 and 1049.

The fork-marker check passes: 487 modified upstream files, 826 fork-owned files, and an empty baseline.

Behavior changes to review

  • Upstream's rule against mode escalation now also applies to the fork's control tools. A session in plan mode cannot prompt or change a session that runs in a broader mode.
  • terminal.observe gets a thread access gate. Its neighbour, terminalAttach, has no gate.

Verification

The host does not allow local builds or tests. CI on this PR verifies the merge. After the merge, stage deploys at https://stagebkt3.dev.beknown.live.

🤖 Generated with Claude Code

Bil0000 and others added 30 commits October 6, 2026 13:19
@Bil0000 @Yash-Singh1
fix(orchestration-v2): show reported subagent models (pingdotgg#14108)
eea9f7c 
Co-authored-by: Yash Singh <saiansh2525@gmail.com>
@jakeleventhal @claude
fix(web): Apple logo no longer dips below the device host label (ping…
9503155 
…dotgg#14825)

Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
@Bil0000 @juliusmarminge
fix(web): show subagent effort and speed in hover cards (pingdotgg#13056
29366ea 
)

Co-authored-by: Julius Marminge <julius0216@outlook.com>
@Bil0000 @juliusmarminge
feat(web): reopen closed tabs across the app (pingdotgg#15207)
b83d731 
Co-authored-by: Julius Marminge <julius0216@outlook.com>
@UtkarshUsername
fix(web): stop wide ordered list markers from clipping (pingdotgg#16523)
8c61e25
@Bombatomica64 @juliusmarminge
fix(desktop): build AppImage with the static runtime toolset (fixes l…
9b2c03e 
…ibfuse2 launch failure) (pingdotgg#7765)

Co-authored-by: Julius Marminge <julius0216@outlook.com>
@bjrump
fix(mobile): keep usage-limit notice opaque (pingdotgg#15602)
7bf6de1
@juliusmarminge @claude
feat(server): GitHub API transport that uses gh only for the token (p…
1564aaa 
…ingdotgg#16319)

Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
@juliusmarminge @claude
feat(server): pull requests talk to GitHub's API instead of the gh CLI (
adc3c93 
pingdotgg#16320)

Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
@juliusmarminge @claude
feat(server): source control, media and discovery use GitHub's API in…
649418f 
…stead of gh (pingdotgg#16321)

Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
@juliusmarminge @claude
feat: choose the GitHub account per host, save a GitHub token, and fe…
9ac8f33 
…wer reads per PR action (pingdotgg#16322)

Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
@juliusmarminge @claude
fix(server): Rebase stack moves each layer onto the rebased layer bel…
1eae9c2 
…ow it (pingdotgg#16551)

Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
@juliusmarminge @claude
fix(web): diff panel keeps the chosen scope while a turn runs (pingdo…
3dfe373 
…tgg#16571)

Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
@juliusmarminge @claude
fix(desktop): honor the telemetry opt-out from the shell profile (pin…
78c9fca 
…gdotgg#16563)

Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
@juliusmarminge @claude
docs(marketing): disclose product usage data in the privacy policy (p…
3b44698 
…ingdotgg#16562)

Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
@juliusmarminge @claude
feat(web): note anonymous usage data in onboarding and link the priva…
115640a 
…cy policy (pingdotgg#16564)

Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
@stevan-borus @juliusmarminge @claude
perf(web): diff panel no longer re-renders every file header each tim…
f21d6da 
…e a patch arrives (pingdotgg#16033)

Co-authored-by: Julius Marminge <51714798+juliusmarminge@users.noreply.github.com>
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
@juliusmarminge @claude
feat(server): every T3 MCP tool declares who may call it (pingdotgg#1…
2f85686 
…6335)

Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
@juliusmarminge @claude
feat(server): outside agents sign in to the T3 MCP server with OAuth (p…
2c8be58 
…ingdotgg#16336)

Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
@juliusmarminge @claude
feat(web): copy an environment's MCP URL for outside agents (pingdotg…
fbe5df2 
…g#16337)

Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
@esthor @juliusmarminge @claude
chore(tsconfig): turn off the Schema-over-JSON diagnostic in test fil…
7bee189 
…es (pingdotgg#16375)

Co-authored-by: Julius Marminge <51714798+juliusmarminge@users.noreply.github.com>
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
@esthor
chore(review): CodeRabbit gates outside contributors' pull requests (p…
c9b21b2 
…ingdotgg#16332)
@juliusmarminge
fix(desktop): include Linux package license and app metadata (pingdot…
f4f148e 
…gg#16597)
@juliusmarminge @claude
fix(server): one failing RPC handler no longer ends the client's othe…
8ddf200 
…r requests (pingdotgg#15515)

Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
@juliusmarminge @claude
fix(contracts): a context record that cannot be encoded no longer fai…
13aabf3 
…ls the send (pingdotgg#16398)

Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
@jakeleventhal
fix(web): open pull request row actions on right-click (pingdotgg#16612)
d8d037e
@maria-rcks
fix(web): show attempted paths in file preview errors (pingdotgg#15628)
876f865
@maria-rcks
fix(vcs): passive sidebar rows stop retaining remote pollers (pingdot…
5055de3 
…gg#15666)
@maria-rcks
feat(web): group keybindings settings by area with a page toolbar (pi…
72d5c32 
…ngdotgg#12822)
@Bil0000
feat(web): stop T3-owned subagents from Lineage (pingdotgg#15211)
c5c6f9c
juliusmarminge and others added 16 commits October 7, 2026 22:48
@juliusmarminge
perf(mobile): remove unused Home project sorting (pingdotgg#16177)
6eed953
@juliusmarminge
perf(mobile): reduce move-menu index allocations (pingdotgg#16256)
7873504
@juliusmarminge
perf(mobile): skip impossible thread-key lookups (pingdotgg#16263)
6c1ce06
@juliusmarminge @claude
fix(mobile): collect UI runtime garbage on iOS memory warnings (pingd…
c001e19 
…otgg#16296)

Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
@juliusmarminge @claude
fix(mobile): stop Git sheet refresh loop (pingdotgg#16305)
5c2798d 
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
@juliusmarminge @claude
fix(mobile): refresh Git status after reconnect (pingdotgg#16329)
4fec120 
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
@juliusmarminge @claude
fix(mobile): update the iOS Git header menu when status changes (ping…
833a03a 
…dotgg#16330)

Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
@juliusmarminge @claude
perf(mobile): reuse the settled sort when settled rows are unchanged (p…
b402f5f 
…ingdotgg#16369)

Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
@juliusmarminge @claude
perf(mobile): highlight source files in small batches that keep gramm…
33afd5a 
…ar state (pingdotgg#16729)

Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
@flamboh
feat(web): quote chips show what you said about the quote (pingdotgg#…
12865b4 
…15703)
@flamboh
feat(web): projectless threads show their machine in the sidebar (pin…
ff9eb8b 
…gdotgg#17022)
@Bil0000
fix(lineage): keep agent effort and speed after completion (pingdotgg…
57f96e6 
…#16925)
@juliusmarminge
fix(mobile): align diff scrolling with glass headers (pingdotgg#17085)
97a65a3
@maria-rcks
fix(web): workspace page headers can no longer grow past the top-bar …
73e097b 
…height (pingdotgg#17086)

Co-authored-by: maria-rcks <254055478+maria-rcks@users.noreply.github.com>
@bk-agent-01 @claude
Merge upstream 73e097b into stage: MCP OAuth for outside agents
cec6fd7 
Brings in upstream's MCP OAuth sign-in (pingdotgg#16336, pingdotgg#16718), per-tool access
declarations (pingdotgg#16335), Copy MCP URL (pingdotgg#16337, pingdotgg#16909), MCP apps (pingdotgg#16236)
and the rest of upstream through 73e097b (139 commits).

Fork layers kept on top of upstream:
- Settings-issued MCP bearer credentials resolve to upstream's client
  caller (clientAccess.expbkt3.ts), so Bifrost/Toolyard keep working.
- Fork control, web UI bridge and session-webhook tools register through
  upstream McpToolAccess declarations.
- OAuth clients bind to the approving team user (actorUserId).
- Per-profile GitHub tokens ported onto upstream's GitHubApi
  (gitHubProfileCredential.expbkt3.ts); GitHubCli.ts removed with upstream.
- New upstream RPCs (mcpApps.*, terminal.observe) get the fork thread gate.
- Upstream migrations 59-60 registered as 1048-1049.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
@bk-agent-01 @claude
chore: mark fork edits displaced by the upstream merge
5d976e7 
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
@github-actions github-actions Bot added vouch:trusted PR author is trusted by repo permissions or the VOUCHED list. size:XXL 📱 Native Change Changes the native fingerprint; merging blocks production OTAs until a new store build ships. labels Oct 8, 2026
bk-agent-01 and others added 9 commits October 8, 2026 07:40
@bk-agent-01 @claude
fix: CI round 1 after the upstream merge
9adb4ec 
- ChatView: drop a leftover fragment of upstream's startThreadTurn line.
- client-runtime: the org user directory atom provides HttpClient itself,
  like upstream's session atom.
- contracts: external-sync:write reports as orchestration:operate to old clients.
- Tests: fork services in upstream's new tests (McpOAuth, bounded snapshot
  transport), fork migration ids (1043, 1048-1049), web UI RPC counts
  (235/31), fork client_version in bootstrap expectations, member pairing
  permissions, HandlersLayer in the PR session-watch test, full startTurn input.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
@bk-agent-01 @claude
fix: review findings and CI round 2 after the upstream merge
9353533 
Security: MCP OAuth approvals now follow the environment identity mode.
In "required" mode an approval must name a team user (Clerk-bound code
or session); an unbound client is an external operator only when its
approver held access:write (signed `mop` claim), otherwise a plain
external user. Shared predicate in mcpApprovalPolicy.expbkt3.ts.

Web: /pair#token links redeem through upstream's pairing surface in
Clerk team mode; the Clerk path reloads after sign-in like upstream;
/pair with a token no longer throws when the managed primary is offline.

Mobile: follow upstream's iosBottomClearance rename, make the fork
threadCostHeader prop optional, mock fork modules that pull the app
runtime in upstream's tests. Server test: optional thread on fork scopes.
Formatting per vp fmt.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
@bk-agent-01 @claude
chore: mark fork edits in MCP approval code
5128402 
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
@bk-agent-01 @claude
style: format MCP approval markers
dace035 
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
@bk-agent-01 @claude
fix: CI round 3 after the upstream merge
de331e7 
- web: reopening a closed plan review panel uses the fork's openPlanReview.
- mobile: upstream's git-actions test expects the fork's per-thread VCS refresh.
- format two source-control files.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
@bk-agent-01 @claude
fix: CI round 4 after the upstream merge
b01eed5 
- RpcInstrumentation covers the fork RPCs through forkRpcGroups.expbkt3.ts.
- Complete fork service mocks in upstream's bounded snapshot test and the
  session-webhook MCP test.
- Lint: fork reads of session client metadata join upstream's allowlist.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
@bk-agent-01 @claude
fix(test): drop two Effect directives the merged fake gh no longer needs
cadd556 
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
@bk-agent-01 @claude
fix(server): pairing redemption binds 1/0, not a boolean, for Node 24…
c7fcce1 
….16 sqlite

Upstream's requested-scope check binds `requestedScopes === undefined`.
node:sqlite on Node 24.16 (the stage server and stage workflow) refuses
boolean parameters, so every pairing redemption failed there.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
@bk-agent-01 @claude
Merge stage (PR #286) into the upstream MCP merge
0446e1d 
Stage shipped migration 1048 (ThreadCommentLastSent), so upstream 59-60
move to 1049-1050. Web UI RPC counts include #286's resend RPC (236).

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
@bk-agent-01
bk-agent-01 marked this pull request as ready for review October 8, 2026 09:31
@bk-agent-01
bk-agent-01 merged commit de44928 into stage Oct 8, 2026
24 of 26 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

📱 Native Change Changes the native fingerprint; merging blocks production OTAs until a new store build ships. size:XXL vouch:trusted PR author is trusted by repo permissions or the VOUCHED list.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.