Merge pull request #332 from docker/oauthflow

Implement OAuth Flow

Author: rumpl

agentfleet_notion-expert.yaml

@@ -0,0 +1,13 @@
+#!/usr/bin/env cagent run
+version: "2"
+
+agents:
+  root:
+    model: anthropic/claude-3-5-sonnet-latest
+    description: Notion Expert
+    instruction: You are an AI assistant with expertise in the Notion project's documentation.
+    toolsets:
+      - type: mcp
+        remote:
+          url: https://mcp.notion.com/sse
+          transport_type: sse

cmd/root/run.go

@@ -23,6 +23,7 @@ import (
 	"github.com/docker/cagent/pkg/chat"
 	"github.com/docker/cagent/pkg/content"
 	"github.com/docker/cagent/pkg/evaluation"
+	"github.com/docker/cagent/pkg/oauth"
 	"github.com/docker/cagent/pkg/remote"
 	"github.com/docker/cagent/pkg/runtime"
 	"github.com/docker/cagent/pkg/session"
@@ -180,6 +181,31 @@ func doRunCommand(ctx context.Context, args []string, exec bool) error {
 			agentFilename = tmpFile.Name()
 		}
 
+		// Set up OAuth redirect URI for CLI/TUI mode
+		if runConfig.RedirectURI == "" {
+			runConfig.RedirectURI = "http://localhost:8083/oauth-callback"
+			slog.Debug("Set default OAuth redirect URI for CLI/TUI mode", "redirectURI", runConfig.RedirectURI)
+
+			// Start OAuth callback server for CLI/TUI mode
+			callbackServer := oauth.NewCallbackServer(8083)
+			err := callbackServer.Start(ctx)
+			if err != nil {
+				slog.Warn("Failed to start OAuth callback server", "error", err)
+			} else {
+				defer func() {
+					shutdownCtx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+					defer cancel()
+					if err := callbackServer.Stop(shutdownCtx); err != nil {
+						slog.Error("Failed to stop OAuth callback server", "error", err)
+					}
+				}()
+				slog.Debug("Started OAuth callback server", "port", 8083)
+
+				// Set up global callback server for OAuth manager
+				oauth.SetGlobalCallbackServer(callbackServer)
+			}
+		}
+
 		agents, err = teamloader.Load(ctx, agentFilename, runConfig)
 		if err != nil {
 			return err
@@ -455,6 +481,22 @@ func runWithoutTUI(ctx context.Context, agentFilename string, rt runtime.Runtime
 					rt.Resume(ctx, string(runtime.ResumeTypeReject))
 					return nil
 				}
+			case *runtime.AuthorizationRequiredEvent:
+				if llmIsTyping {
+					fmt.Println()
+					llmIsTyping = false
+				}
+
+				if e.Confirmation == "pending" {
+					result := promptOAuthAuthorization(e.ServerURL, e.ServerType)
+					switch result {
+					case ConfirmationApprove:
+						rt.ResumeStartAuthorizationFlow(ctx, true)
+					case ConfirmationReject:
+						rt.ResumeStartAuthorizationFlow(ctx, false)
+						return fmt.Errorf("OAuth authorization rejected by user")
+					}
+				}
 			}
 		}
 

cmd/root/run_text_utils.go

@@ -139,6 +139,32 @@ func promptMaxIterationsContinue(maxIterations int) ConfirmationResult {
 	}
 }
 
+func promptOAuthAuthorization(serverURL, serverType string) ConfirmationResult {
+	fmt.Printf("\n%s\n", yellow("🔐 OAuth Authorization Required"))
+	fmt.Printf("%s %s (%s)\n", white("Server:"), blue(serverURL), serverType)
+	fmt.Printf("%s\n", white("This server requires OAuth authentication to access its tools."))
+	fmt.Printf("%s\n", white("Your browser will open automatically to complete the authorization."))
+	fmt.Printf("\n%s (y/n): ", blue("Do you want to authorize access?"))
+
+	reader := bufio.NewReader(os.Stdin)
+	response, err := reader.ReadString('\n')
+	if err != nil {
+		fmt.Printf("\n%s\n", red("Failed to read input, aborting authorization..."))
+		return ConfirmationAbort
+	}
+
+	response = strings.TrimSpace(strings.ToLower(response))
+	if response == "y" || response == "yes" {
+		fmt.Printf("%s\n", green("✓ Starting OAuth authorization..."))
+		fmt.Printf("%s\n", white("Please complete the authorization in your browser."))
+		fmt.Printf("%s\n\n", white("Once completed, the agent will continue automatically."))
+		return ConfirmationApprove
+	} else {
+		fmt.Printf("%s\n\n", white("Authorization declined. Exiting..."))
+		return ConfirmationReject
+	}
+}
+
 func formatToolCallArguments(arguments string) string {
 	if arguments == "" {
 		return "()"

examples/README.md

@@ -41,6 +41,7 @@ These are more advanced examples, most of them involve some sort of MCP server t
 | [doc_generator.yaml](doc_generator.yaml)               | Documentation generation from codebases     |            | ✓     |      | ✓     |        |                                                                                                                                |            |
 | [mcp_generator.yaml](mcp_generator.yaml)               | Generates MCP configurations                |            |       |      |       |        | docker,[duckduckgo](https://hub.docker.com/mcp/server/duckduckgo/overview)                                                     |            |
 | [couchbase_agent.yaml](couchbase_agent.yaml)           | Run Database commands using MCP tools       |            |       |      |       |        | docker,[couchbase](https://hub.docker.com/mcp/server/couchbase/overview)                                          |            |
+| [notion-expert.yaml](notion-expert.yaml)               | Notion documentation expert using OAuth      |            |       |      |       |        | [notion](https://mcp.notion.com) (uses OAuth)                                                                     |            |
 
 ## **Multi-Agent Configurations**
 

examples/notion-expert.yaml

@@ -0,0 +1,13 @@
+#!/usr/bin/env cagent run
+version: "2"
+
+agents:
+  root:
+    model: anthropic/claude-3-5-sonnet-latest
+    description: Notion Expert
+    instruction: You are an AI assistant with expertise in the Notion project's documentation.
+    toolsets:
+      - type: mcp
+        remote:
+          url: https://mcp.notion.com/sse
+          transport_type: sse

pkg/app/app.go

@@ -84,3 +84,10 @@ func (a *App) Resume(confirmationType string) {
 		a.runtime.Resume(context.Background(), confirmationType)
 	}
 }
+
+// ResumeStartOAuth resumes the runtime with OAuth authorization confirmation
+func (a *App) ResumeStartOAuth(confirmation bool) {
+	if a.runtime != nil {
+		a.runtime.ResumeStartAuthorizationFlow(context.Background(), confirmation)
+	}
+}