Repository navigation
fix(mcp): translate oauth into the shape Zoo Code validates for .roo/mcp.json - #3633
Merged
Merged
Conversation
…mcp.json Zoo Code now validates `oauth` per transport (Zoo-Code-Org/Zoo-Code#2129): stdio and sse servers reject it, streamable-http requires a non-empty `clientId`, and one rejected entry makes Zoo Code load none of the project servers. The shared Roo/Zoo adapter copied the canonical Claude-style block verbatim. - Keep `oauth` only on `type: "http"` (streamable-http) servers; drop it with a warning from stdio, sse and untyped url servers. - Drop the block with a warning when `clientId` is missing or empty. - Map Claude's `callbackPort` to `redirectUri: http://127.0.0.1:<port>/callback`, pass `clientId`, `scope`, `redirectUri` and `resource` through, and drop other keys (e.g. `authServerMetadataUrl`) with a warning. - On import, read a loopback `/callback` redirectUri back as `callbackPort`. The rules apply to both the `roo` and `zoocode` targets, which share `.roo/mcp.json`; Roo Code never read `oauth`. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0179ZomNiDQHCzgoxeRVmfth
- Drop a `redirectUri` that is not a URL and a `resource` that is not "auto", false or a URL, since Zoo Code rejects the whole file for them. - On import, lift only the exact `http://127.0.0.1:<port>/callback` form generate writes back to `callbackPort`; keep a `localhost` redirect URI as written so the registered redirect URI survives a round trip. - Join a canonical `scopes` list into `scope` when no `scope` is given. - Reuse the shared `isPlainObject` type guard and correct the reason given for dropping `oauth` from untyped url servers. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0179ZomNiDQHCzgoxeRVmfth
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Zoo Code now validates
oauthper transport (Zoo-Code-Org/Zoo-Code#2129, onmainafter v3.92.0): stdio and sse servers declareoauth: z.undefined(), streamable-http accepts{ clientId (required, non-empty), scope?, redirectUri?, resource? }, andMcpSettingsSchema.safeParseruns on the whole project file, so one rejected entry makes Zoo Code load none of the servers in.roo/mcp.json. The shared Roo/Zoo adapter (RooMcp) copied the canonical Claude-styleoauthblock verbatim.Changes
src/features/mcp/roo-mcp.ts(used by bothrooandzoocode):oauthis kept only on atype: "http"server (written asstreamable-http). It is dropped with a warning from stdio, sse and untypedurlservers. Zoo Code picks the schema fromtypealone, so a server with onlytransport: "http"counts as sse.clientIdis dropped with a warning.clientId,scope,redirectUriandresourcepass through. Claude'scallbackPortbecomesredirectUri: "http://127.0.0.1:<port>/callback"(the loopback callback Zoo Code listens on; an explicitredirectUriwins). Other keys such asauthServerMetadataUrlare dropped with a warning.http://127.0.0.1|localhost:<port>/callbackredirectUriis read back ascallbackPort, so generate/import round-trips.rootarget gets the same rules. Roo Code never readoauth, and Zoo Code reads the same.roo/mcp.json.Docs: the Roo Code / Zoo Code MCP note in
docs/reference/file-formats.md(plus the regenerateddocs-content.ts).Not included: the optional tool-scoped
zoocode.mcpServersoverride for Zoo-onlyresource. Aresourcealready in canonicaloauthpasses through.Tests
New unit tests in
roo-mcp.test.tscover the callbackPort mapping, explicit redirectUri/resource, dropped unknown keys, a missing clientId, stdio/sse/untyped servers, the import mapping and the round trip.pnpm cicheckpasses.Closes #3629
🤖 Generated with Claude Code
https://claude.ai/code/session_0179ZomNiDQHCzgoxeRVmfth