Skip to content

plan: TypeScript SDK MCP authorization lifecycle #1687

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
samuv merged 4 commits into from
Sep 18, 2026
+599 −12
Merged

plan: TypeScript SDK MCP authorization lifecycle #1687

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
94f7861
plan: TypeScript SDK MCP authorization lifecycle
samuv Sep 17, 2026
488004c
docs: link SDK authorization plan PR
samuv Sep 17, 2026
82eadd8
docs(sdk): define authorization recovery lifecycle
samuv Sep 18, 2026
28868b2
docs(sdk): acknowledge authorization relay lifecycle
samuv Sep 18, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 8 additions & 6 deletions contracts/gen/go/mecatl/v1/harness_grpc.pb.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

7 changes: 4 additions & 3 deletions contracts/proto/mecatl/v1/harness.proto
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -97,9 +97,10 @@ service HarnessService {

// Converse drives one run. The first frame MUST be `prompt` or `retry`; later
// frames may carry controls. A received second `prompt` or `retry` is rejected
// with INVALID_ARGUMENT. The server streams `Event` envelopes until the terminal
// `result` event, then closes the stream; controls still in transit may instead
// observe normal stream completion. A context cancel from the client aborts the run.
// with INVALID_ARGUMENT. The server streams `Event` envelopes until either a
// terminal `result` or a pending `authorization.required` park, then closes the
// stream; controls still in transit may instead observe normal stream completion.
// A context cancel from the client aborts the run.
rpc Converse(stream ConverseRequest) returns (stream ConverseResponse);

// ResolveRunAsk resolves one ordinary permission ask on the exact addressed
Expand Down
4 changes: 4 additions & 0 deletions docs/acceptance/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -335,6 +335,10 @@ PR after verification. There is no cleanup or status-only PR.
ordinary ask resolution, cancellation, strict multimodal steering, and pending-steer
retraction over gRPC and HTTP through `session.controls(runId)`, with request options,
bounded correlated acknowledgements, and mandatory stale-run guards. Status: proposed.
- [TypeScript SDK MCP authorization lifecycle](sdk-mcp-authorization-lifecycle.md) — a
session-bound authorization handle with live URL presentation, explicit typed recheck/cancel
flows, exact-run permission controls, single-consumption correlation, and honest
disconnect/recovery semantics over gRPC and HTTP. Status: proposed.
- [TypeScript SDK HTTP well-known-type JSON compatibility](sdk-http-wkt-json-compatibility.md) —
descriptor-guided Timestamp and Duration decoding for daemon stdlib-JSON responses across unary
HTTP and SSE, preserving ProtoJSON strings, typed failures, and the registered raw response.
Expand Down
Loading
Loading