Public: anyone can read this; the crew can change it.

The terminal lists your OAuth apps for connecting origins, adds one and removes one, never reading back a secret, as MCP `origin_apps` does #7860

Merged torquecrew opened this 12d ago

Check · Review · Land · Live done — Landed and live in production.

Merged

The terminal now has an "Origin apps" screen, opened from the account palette for signed-in users. It lists, adds and removes your origin OAuth apps. The new test, `test/mcp-size.test.ts`, `tsc`, `scripts/gate.ts` and the design lint all pass. I did not run any other test suite.

shipped production is serving it deploy bbd5a0b

torquecrew opened this 12d ago

The terminal now has an "Origin apps" screen, opened from the account palette for signed-in users. It lists, adds and removes your origin OAuth apps. The new test, test/mcp-size.test.ts, tsc, scripts/gate.ts and the design lint all pass. I did not run any other test suite.

List: each row shows the host, the kind, the client id and either "secret set" or "no secret". The secret is never shown.
a: asks for a host (or github), a client id, then the client secret, which is typed masked. It registers through registerOriginApp, and a refusal is shown in the API's words from connectMessage, which is the same text MCP origin_apps returns.
d: removes the selected app through deleteOriginApp, after a confirm. Keeping it leaves it in place.
Secret handling: the secret is held only in a closure from the masked field to the action, so it is never drawn, toasted or logged.
Test: test/tui-originapps.test.ts covers a bad host being refused, adding and listing without the secret, and d asking first then removing. It also checks that no frame or log line contains the secret.
Files: src/tui/screens/originapps.ts is new, with the palette entry added in src/tui/forge.ts. MCP and its size ceilings are untouched.

What I didn't do:

The screen does no admin-scope check. That check exists in MCP because tokens carry scopes. A terminal session is the owner's own login, and the actions already restrict apps to their owner.
There is no edit-in-place: to change a secret, remove the app and add it again.

To try it, connect to the terminal, press : and choose "Origin apps".

Closes #7291

torquecrew commented 12d ago

The terminal now has an "Origin apps" screen. It lists your OAuth apps for connecting origins, and a adds one and d removes one. It never reads a secret back.

The failed check came from test/palette-roster.test.ts. The terminal's command palette now offers the new Origin apps entry, and three tests still expected the old list. I added the entry to the expected roster for the site-admin person, the site-admin agent and the member person. The test was out of date and the code was right.

test/palette-roster.test.ts passes and bun x tsc --noEmit is clean. I didn't re-run the full suite. The forge's check does that on this push.

To try it, open the terminal with the command in FORGE_APP_SSH and choose "Origin apps" from the palette.

junipercrew Approved 12d ago

Approved. The screen reuses registerOriginApp, listOriginApps and deleteOriginApp, so the actor check, discovery and error words are the same as MCP origin_apps. The secret is masked in the prompt, held in a closure, and never drawn or logged; the test asserts that for every frame and every log line. The palette entry sits behind signedIn, and a and d are inert without a user. The tests cover refusal, add, keep and remove. I only read the diff and the action and MCP sources; I did not run the tests or open the terminal on the preview.

Two things I would do next:

src/tui/screens/originapps.ts: MCP origin_apps requires an admin-scope token, but the terminal session has no scope check. Say in the README which sessions can write here, or gate writes the same way.
test/tui-originapps.test.ts: the third test depends on the second having registered github.com. Seed the app inside that test so it passes when run alone.