feat: sync upstream v1.0.5-preview.0 — MCP OAuth handler + schema 1.0.66-2 - #143
Merged
Conversation
…ync) Sync upstream github/copilot-sdk v1.0.4 -> v1.0.5-preview.0 (@github/copilot 1.0.65 -> 1.0.66-2). This is a preview sync against a prerelease CLI. - Bump .copilot-schema-version to 1.0.66-2 and regenerate the pinned schemas and generated wire event specs (bb schemas:fetch + bb codegen). - Add the new public session events surfaced by schema 1.0.66 to the curated sets in github.copilot-sdk: assistant.idle (assistant-events), session.response_limits_changed (session-events), and mcp.headers_refresh_required / mcp.headers_refresh_completed (interaction-events); all also added to the top-level event-types set. - Bump Clojure SDK version to 1.0.5.0 (build.clj, README, getting-started). Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Port upstream PR #1669: SDK support for the interactive MCP OAuth
lifecycle. create-session and resume-session accept an optional
:on-mcp-auth-request handler.
When provided, the SDK registers interest in the mcp.oauth_required event
so the runtime delegates browser-based OAuth to the handler instead of
silently using a cached token. Interest is registered BEFORE the runtime
begins MCP work — before the mode-options patch on create and before the
session.resume RPC on resume — matching upstream client.ts (1477 create,
1578 resume). A failed registerInterest now rejects session
creation/resume (with cleanup) rather than being silently swallowed.
The 2-arg handler (fn [request ctx]) receives an idiomatic McpAuthRequest
map and {:session-id ...}, and may return a core.async channel. A result
with :access-token answers with a token; nil, {:kind :cancelled}, or a
thrown exception cancels the pending request (matching upstream's
error-swallowing behavior).
- client.clj: broadcast case + registerInterest helpers (sync + async),
reordered call sites across all 6 create/resume paths.
- session.clj: handle-mcp-auth-request! + mcp-auth-result->wire mapping.
- specs.clj: ::on-mcp-auth-request, wired into session/resume/join configs.
- tests: 10 integration tests covering token/cancel/nil/bare-token/thrown
results, register-interest ordering on create+resume (sync + async), and
registerInterest-failure rejecting creation; mock handlers for
session.mcp.oauth.handlePendingRequest and eventLog.register/releaseInterest.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
- API.md: add :on-mcp-auth-request to the session options table, a new "MCP OAuth Handler" section (McpAuthRequest shape + result mapping), and complete the Event Types table with the events surfaced by schema 1.0.66 (assistant.idle, mcp.headers_refresh_required/completed, session.response_limits_changed) plus the v1.0.4-era events that were added to the curated set but not yet documented. - mcp/overview.md: add an "Interactive OAuth" section. - CHANGELOG.md: new "### Added (v1.0.5-preview.0 sync)" subsection citing upstream #1669 (MCP OAuth) and #1796 (BYOK sessionId parity, already satisfied — no code change). - Regenerate Codox API HTML from updated docstrings. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Contributor
There was a problem hiding this comment.
Pull request overview
Syncs the Clojure Copilot SDK to upstream v1.0.5-preview.0 / schema @github/copilot 1.0.66-2, primarily adding an experimental MCP OAuth request handler surface and updating curated event-type exports/docs accordingly.
Changes:
- Add optional
:on-mcp-auth-requesthandler support, including registeringmcp.oauth_requiredinterest at the required points in create/resume and responding viasession.mcp.oauth.handlePendingRequest. - Regenerate/update schema artifacts and expose newly added public event types in the curated
event-typessets. - Update tests, docs, changelog, and versions to
1.0.5.0.
Show a summary per file
| File | Description |
|---|---|
src/github/copilot_sdk/client.clj |
Implements v3 mcp.oauth_required handling and registers eventLog.registerInterest pre-work on create/resume with cleanup-on-failure. |
src/github/copilot_sdk/session.clj |
Stores the MCP auth handler in session state and adds helper to map handler results to wire responses. |
src/github/copilot_sdk/specs.clj |
Adds ::on-mcp-auth-request and wires it into create/resume/join config specs and closed key sets. |
src/github/copilot_sdk.clj |
Updates curated exported event keyword sets for schema 1.0.66-2 additions. |
test/github/copilot_sdk/mock_server.clj |
Extends mock RPC surface and known-event-types to cover MCP OAuth interest + handling. |
test/github/copilot_sdk/integration_test.clj |
Adds integration coverage for interest registration ordering and handlePendingRequest result mapping/cancellation semantics. |
schemas/session-events.schema.json |
Updates pinned upstream session-event schema (1.0.66-2), adding new event/data definitions and attachment variants. |
schemas/README.md |
Updates displayed pinned schema version to 1.0.66-2. |
.copilot-schema-version |
Bumps pinned schema version to 1.0.66-2. |
README.md |
Updates dependency snippet to 1.0.5.0. |
doc/getting-started.md |
Updates dependency snippet to 1.0.5.0. |
doc/reference/API.md |
Documents :on-mcp-auth-request and adds MCP OAuth handler section + event reference updates. |
doc/mcp/overview.md |
Adds an “Interactive OAuth” section describing the new handler and linking to reference docs. |
doc/api/API.html |
Regenerated HTML docs reflecting the new MCP OAuth handler docs and event reference updates. |
doc/api/overview.html |
Regenerated HTML docs reflecting the MCP Interactive OAuth section. |
doc/api/github.copilot-sdk.client.html |
Regenerated Codox output for client docs, including the new config option description. |
doc/api/github.copilot-sdk.session.html |
Regenerated Codox output for session docs, including the new handle-mcp-auth-request! var docs. |
doc/api/getting-started.html |
Regenerated HTML docs reflecting the version bump. |
doc/api/byok.html |
Regenerated HTML docs with clarified BYOK provider/models constraint wording. |
CHANGELOG.md |
Adds an [Unreleased] section entry describing the preview sync, handler addition, and new events. |
build.clj |
Bumps library version to 1.0.5.0. |
Review details
- Files reviewed: 21/23 changed files
- Comments generated: 3
- Review effort level: Low
Address Copilot Code Review feedback on #143: - mcp-auth-result->wire: only include :token-type / :expires-in when the value is non-nil (some? instead of contains?), so a handler result with an explicit nil optional field no longer serializes to tokenType: null / expiresIn: null. Extend the bare-token test to assert omission. - Replace `<id>` / `<name>` angle-bracket placeholders in the handle-mcp-auth-request! and handle-provider-token-request! docstrings with `...`; the angle brackets rendered as stray HTML tags in the Codox output. Regenerate the API HTML. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
The mcp.oauth_required wire spec defines resourceMetadata as a string (a raw OAuth protected-resource metadata document), not a parsed map. Fix the McpAuthRequest field table in API.md and regenerate the API HTML so the docs no longer mislead consumers into treating it as parsed JSON. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
A handler returning {:access-token nil} previously mapped to
{:kind "token" :access-token nil}, which clj->wire would serialize as
accessToken: null and fail the runtime's string-typed handlePendingRequest.
Gate the token branch on a non-nil access token (some? instead of
contains?); a nil token now falls through to {:kind "cancelled"}. Add a
nil-token case to the cancellation test.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Syncs the Clojure SDK with upstream
github/copilot-sdkv1.0.4 -> v1.0.5-preview.0, bumping the pinned CLI schema from@github/copilot1.0.65 -> 1.0.66-2. This is a preview sync against a prerelease CLI; the new MCP OAuth surface is@experimentalupstream.The headline change ports upstream #1669: a new optional
:on-mcp-auth-requesthandler oncreate-session/resume-sessionthat lets a consumer drive interactive (browser-based) MCP OAuth instead of the runtime silently falling back to a cached token.:on-mcp-auth-requestMirrors
:on-permission-request. When supplied, the SDK registers interest in themcp.oauth_requiredevent; the runtime then delegates pending OAuth to the handler, which receives an idiomaticMcpAuthRequestmap plus{:session-id ...}and may return a core.async channel. A result containing:access-tokenanswers with a token;nil,{:kind :cancelled}, or a thrown exception cancels the request (matching upstream's error-swallowing semantics).Ordering is load-bearing: interest must be registered before the runtime begins MCP work — before the mode-options patch on create and before the
session.resumeRPC on resume — matching upstreamclient.ts(1477 create / 1578 resume). A failedregisterInterestnow rejects session creation/resume with cleanup rather than being swallowed, so a consumer never gets a half-initialized session that silently won't deliver OAuth prompts.Also in this sync
assistant.idle,session.response_limits_changed,mcp.headers_refresh_required,mcp.headers_refresh_completed.sessionId(#1796) — parity confirmed, no code change. The:bearer-token-providercallback already receives:session-id(since the v1.0.4 sync).Validation
bb test(E2E) 396/0/0 ·./run-all-examples.sh25/25 ·bb validate-docs0 warnings · jar1.0.5.0builds.Non-goals
CLI-only internal RPCs (
session.mcp.oauth.login/.respond) are not exposed — only the SDK-surface handler upstream ships.