Appearance
MCP Auth Lifecycle
Source Map
| File | Symbol | Runtime responsibility |
|---|---|---|
source/host/mcp-auth/mcp-auth-wait-registry.ts | McpAuthWaitRegistry | 保存正在等待认证完成的 Agent / Server 关联 |
| 同上 | register() | connector/server identity → wait entry + TTL |
| 同上 | take() | auth completion → consume matching wait → agentId |
| 同上 | prune() | 清理过期 wait |
source/host/mcp-auth/host-mcp-auth-completion.ts | registerConnectCard() | 将 auth UI/connect event 注册为 wait |
| 同上 | resolve() | completion identity → choose agent → resume transcript |
| 同上 | resolveDesktop() | connector management restart 后复用 resolve() |
Control Flow
text
Agent needs protected MCP connector
↓
register(agentId, connector, serverId)
↓
WAITING_AUTH
│
├──── TTL expires → prune
│
OAuth / external auth completes
↓
HostMcpAuthCompletion.resolve(completion)
↓
waits.take(serverId/serverName)
↓
resolve target agentId
↓
resumeAfterMcpAuth(...)这里最值得学的是 wait identity + completion correlation + resume。OAuth 本身是协议问题；Harness 还要把协议完成事件可靠关联回被暂停的 Agent。
边界
McpAuthWaitRegistry不是 token store。host-secret-store.ts在该快照中主要维护 host machine id，不能拿来证明 OAuth credential 的安全存储方式。- MCP Authorization 的 wire-level 规则仍以正式规范为准。
Local Locate
bash
rg -n "class McpAuthWaitRegistry|register\(|take\(|prune\(" source/host/mcp-auth/mcp-auth-wait-registry.ts
rg -n "class HostMcpAuthCompletion|registerConnectCard|resolve\(|resolveDesktop" source/host/mcp-auth/host-mcp-auth-completion.ts