From 11c10fd0c4ae45d8a94a2d94e82a82be7ea580b4 Mon Sep 17 00:00:00 2001 From: Madraka <8898640+Madraka@users.noreply.github.com> Date: Tue, 10 Nov 2026 03:01:30 +0300 Subject: [PATCH] chore(release): MCP OAuth ships as 0.7.0, not a patch RFC-0044 adds an OAuth 2.1 authorization server, client registration, two migrations (0031_oauth, 0032_oauth_client_kind_index) and a Better Auth bump: a feature release. In the fixed group one minor changeset moves every package to 0.7.0, so downstream patch auto-merges (cloudhal.com's Dependabot rule) wait for a person. Co-Authored-By: Claude Opus 5.5 Signed-off-by: Madraka <8898640+Madraka@users.noreply.github.com> --- .changeset/mcp-oauth-authorization-server.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/.changeset/mcp-oauth-authorization-server.md b/.changeset/mcp-oauth-authorization-server.md index d4fab35f..03011976 100644 --- a/.changeset/mcp-oauth-authorization-server.md +++ b/.changeset/mcp-oauth-authorization-server.md @@ -1,8 +1,8 @@ --- -"@cloudhal/storage": patch -"@cloudhal/api": patch -"@cloudhal/cloudflare": patch -"@cloudhal/cli": patch +"@cloudhal/storage": minor +"@cloudhal/api": minor +"@cloudhal/cloudflare": minor +"@cloudhal/cli": minor --- Remote MCP clients can now authorize with OAuth 2.1 against the deployment itself (RFC-0044 Phase 2, ADR-0045). Better Auth's `mcp()` and `jwt()` plugins run in the Studio's auth instance when the runtime has a stable public origin: the admin Worker uses its origin, `cloudhal studio` needs `--base-url` / `CLOUDHAL_BASE_URL` (it logs why OAuth is off otherwise), and `CLOUDHAL_MCP_OAUTH=off` turns it off. Access tokens are Ed25519 JWTs bound to `/mcp` for one hour, refresh tokens rotate with a 30-second reuse window, and each connection is approved on Studio's new consent screen (`/oauth/consent`), which narrows the requested scopes by the member's role and records an `agent_grants` row (migration `0031_oauth`). A token resolves to the same principal an agent key does; revoking a connection (`DELETE /api/agent-grants/:id`) or removing the member refuses it on its next call. The Better Auth family moves to 1.7.18. Client registration (CIMD, DCR) and the "Connected agents" screen follow in Phase 3.