feat(desktop): add MCP OAuth support for remote servers

apps/desktop/electron/main/bootstrap/shutdown.ts

@@ -12,6 +12,7 @@ import type { PluginViewHost } from "../plugin-view-host";
 import type { AppUpdaterController } from "../updater";
 import type { UserMcpRuntime } from "../user-mcp";
 import type { McpControlServer } from "../mcp-control";
+import type { McpOAuthManager } from "../mcp-oauth";
 
 const QUIT_TURN_SETTLE_BUDGET_MS = 2_000;
 
@@ -38,6 +39,7 @@ export type ShutdownDependencies = {
   pluginPanels: Pick<PluginPanelHost, "closeAll">;
   plugins: Pick<PluginRuntime, "disposeAll">;
   userMcp: Pick<UserMcpRuntime, "disposeAll">;
+  mcpOAuth?: Pick<McpOAuthManager, "disposeAll">;
   browserPane: Pick<BrowserPane, "dispose">;
   pluginViews: Pick<PluginViewHost, "dispose">;
   pluginSettingsViews: Pick<PluginViewHost, "dispose">;
@@ -59,6 +61,7 @@ export function registerShutdownHandlers({
   pluginPanels,
   plugins,
   userMcp,
+  mcpOAuth,
   browserPane,
   pluginViews,
   pluginSettingsViews,
@@ -147,6 +150,7 @@ export function registerShutdownHandlers({
       // end every quit in error logs, toasts, and restarts into a closing app.
       const pluginShutdown = plugins.disposeAll();
       userMcp.disposeAll();
+      mcpOAuth?.disposeAll();
       browserPane.dispose();
       pluginViews.dispose();
       pluginSettingsViews.dispose();

apps/desktop/electron/main/index.ts

@@ -675,6 +675,7 @@ const pluginServices = createPluginServices({
 const {
   plugins,
   userMcp,
+  mcpOAuth,
   pluginScopes,
   sessionProjects,
   emitBrowserState,
@@ -1323,6 +1324,7 @@ function registerIpc() {
     dispatchExecutionForProposal,
     emitAgentEvent,
     userMcp,
+    mcpOAuth,
     refreshUserMcp,
     describeError,
     activeUserSubagentDocuments,
@@ -1482,6 +1484,7 @@ registerShutdownHandlers({
   pluginPanels,
   plugins,
   userMcp,
+  mcpOAuth,
   browserPane,
   pluginViews,
   pluginSettingsViews,

apps/desktop/electron/main/ipc/mcp-ipc.ts

@@ -1,4 +1,5 @@
 import { IPC, parseMcpImport, type ActivationScope, type AgentCapabilityMove, type AgentCapabilityQuery, type MarketSource, type McpServerInput, type McpServerRecord, type McpServerStatus } from "@pi-desktop/shared";
+import type { McpOAuthManager } from "../mcp-oauth";
 import type { HostProcess } from "../host-process";
 import type { McpRegistrySearchResult } from "../mcp-registry-catalog";
 import type { UserMcpRuntime } from "../user-mcp";
@@ -8,6 +9,7 @@ export type McpIpcDependencies = {
   registrar: IpcRegistrar;
   getHost: () => HostProcess | null;
   userMcp: UserMcpRuntime;
+  oauth?: McpOAuthManager;
   currentWorkspacePath: () => string | null;
   refreshUserMcp: (projectPath?: string | null) => Promise<McpServerRecord[]>;
   describeError: (error: unknown) => string;
@@ -24,6 +26,7 @@ export function registerMcpIpc({
   registrar,
   getHost,
   userMcp,
+  oauth,
   currentWorkspacePath,
   refreshUserMcp,
   describeError,
@@ -59,14 +62,28 @@ handle(IPC.invoke.mcpList, async (query: Partial<AgentCapabilityQuery> = {}) =>
     // Status belongs to the currently open project's active runtime, while the
     // list itself must include disabled records for the settings page.
     await refreshUserMcp(currentWorkspacePath());
-    return { servers: result.servers ?? [], statuses: userMcp.listStatuses() };
+    const statuses = await Promise.all(
+      userMcp.listStatuses().map(async (status) => ({
+        ...status,
+        hasOauth: oauth ? await oauth.hasOAuth(status.serverId) : false,
+      })),
+    );
+    return { servers: result.servers ?? [], statuses };
   });
 
   handle(IPC.invoke.mcpUpsert, async (server: McpServerInput) => {
     if (!host) throw new Error("host unavailable");
     const res = await host.call<{ server: McpServerRecord }>("mcp.upsert", { server });
     await refreshUserMcp(currentWorkspacePath());
-    sendToRenderer(IPC.event.pluginChanged,{ reason: "mcp", pluginId: res.server?.id });
+    sendToRenderer(IPC.event.pluginChanged, { reason: "mcp", pluginId: res.server?.id });
+    if (res.server && res.server.enabled !== false) {
+      void userMcp
+        .test(res.server.id)
+        .then(() => {
+          sendToRenderer(IPC.event.pluginChanged, { reason: "mcp", pluginId: res.server.id });
+        })
+        .catch(() => {});
+    }
     return res;
   });
 
@@ -75,6 +92,7 @@ handle(IPC.invoke.mcpList, async (query: Partial<AgentCapabilityQuery> = {}) =>
     async (payload: { id: string } & Partial<AgentCapabilityQuery>) => {
       if (!host) throw new Error("host unavailable");
       const res = await host.call("mcp.remove", payload);
+      await oauth?.deleteOAuth(payload.id);
       await refreshUserMcp(currentWorkspacePath());
       sendToRenderer(IPC.event.pluginChanged,{ reason: "mcp", pluginId: payload.id });
       return res;
@@ -113,6 +131,9 @@ handle(IPC.invoke.mcpList, async (query: Partial<AgentCapabilityQuery> = {}) =>
   handle(IPC.invoke.mcpTransfer, async (payload: AgentCapabilityMove) => {
     if (!host) throw new Error("host unavailable");
     const res = await host.call<{ server: McpServerRecord }>("mcp.transfer", payload);
+    if (res.server?.id && payload.id && payload.id !== res.server.id) {
+      await oauth?.transferOAuth(payload.id, res.server.id);
+    }
     await refreshUserMcp(currentWorkspacePath());
     sendToRenderer(IPC.event.pluginChanged,{ reason: "mcp", pluginId: res.server?.id });
     return res;
@@ -137,7 +158,37 @@ handle(IPC.invoke.mcpList, async (query: Partial<AgentCapabilityQuery> = {}) =>
       const status = await userMcp.test(payload.id);
       await refreshUserMcp(currentWorkspacePath());
       sendToRenderer(IPC.event.pluginChanged,{ reason: "mcp", pluginId: payload.id });
-      return { status };
+      const hasOauth = oauth ? await oauth.hasOAuth(payload.id) : false;
+      return { status: { ...status, hasOauth } };
+    },
+  );
+
+  handle(
+    IPC.invoke.mcpOauthStart,
+    async (payload: { id: string } & Partial<AgentCapabilityQuery>) => {
+      if (!host) throw new Error("host unavailable");
+      if (!oauth) throw new Error("OAuth manager unavailable");
+      const query = {
+        ...(payload.level ? { level: payload.level } : {}),
+        ...(payload.projectPath ? { projectPath: payload.projectPath } : {}),
+      } satisfies Partial<AgentCapabilityQuery>;
+      const listed = await host.call<{ servers: McpServerRecord[] }>("mcp.list", query);
+      const server = listed.servers.find((item) => item.id === payload.id);
+      if (!server) throw new Error(`MCP server not found: ${payload.id}`);
+      if (server.transport !== "http" || !server.url) {
+        throw new Error(`MCP server ${payload.id} is not an HTTP transport server`);
+      }
+
+      return oauth.start(server.id, server.url);
+    },
+  );
+
+  handle(
+    IPC.invoke.mcpOauthCancel,
+    async (payload: { loginId?: string; id?: string }) => {
+      if (!oauth) return { ok: false };
+      const target = payload?.loginId || payload?.id;
+      return { ok: typeof target === "string" && oauth.cancel(target) };
     },
   );
 

apps/desktop/electron/main/ipc/register.ts

@@ -10,6 +10,7 @@ import { registerAppIpc } from "./app-ipc";
 import { registerDiagnosticsIpc } from "./diagnostics-ipc";
 import { registerMarketIpc } from "./market-ipc";
 import { registerMcpIpc } from "./mcp-ipc";
+import type { McpOAuthManager } from "../mcp-oauth";
 import { searchMcpMarket } from "../mcp-registry-catalog";
 import { registerNotificationIpc } from "./notification-ipc";
 import { registerPluginIpc } from "./plugin-ipc";
@@ -37,6 +38,7 @@ export type RegisterIpcDependencies = {
   setNotificationViewingSessionId: (sessionId: string | null) => void;
   activeUserSubagentDocuments: (...args: any[]) => Promise<any>;
   disabledBuiltinSubagents: () => Promise<string[]>;
+  mcpOAuth?: McpOAuthManager;
   [name: string]: any;
 };
 
@@ -123,6 +125,7 @@ export function registerIpcHandlers(dependencies: RegisterIpcDependencies) {
     dispatchExecutionForProposal,
     emitAgentEvent,
     userMcp,
+    mcpOAuth,
     refreshUserMcp,
     describeError,
     pluginViews,
@@ -348,6 +351,7 @@ export function registerIpcHandlers(dependencies: RegisterIpcDependencies) {
     registrar,
     getHost,
     userMcp,
+    oauth: mcpOAuth,
     currentWorkspacePath,
     refreshUserMcp,
     describeError,