feat: surface MCP OAuth sidecar events

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

sidecar/src/Aryx.AgentHost/Services/CopilotMcpOAuthCoordinator.cs

@@ -0,0 +1,58 @@
+using Aryx.AgentHost.Contracts;
+using GitHub.Copilot.SDK;
+
+namespace Aryx.AgentHost.Services;
+
+internal sealed class CopilotMcpOAuthCoordinator
+{
+    public McpOauthRequiredEventDto BuildMcpOauthRequiredEvent(
+        RunTurnCommandDto command,
+        PatternAgentDefinitionDto agent,
+        McpOauthRequiredEvent request)
+    {
+        ArgumentNullException.ThrowIfNull(command);
+        ArgumentNullException.ThrowIfNull(agent);
+        ArgumentNullException.ThrowIfNull(request);
+
+        McpOauthRequiredData requestData = request.Data
+            ?? throw new InvalidOperationException("MCP OAuth request data is required.");
+
+        string oauthRequestId = NormalizeOptionalString(requestData.RequestId)
+            ?? throw new InvalidOperationException("MCP OAuth request ID is required.");
+        string? normalizedAgentId = NormalizeOptionalString(agent.Id);
+        string? normalizedAgentName = NormalizeOptionalString(agent.Name) ?? normalizedAgentId;
+
+        return new McpOauthRequiredEventDto
+        {
+            Type = "mcp-oauth-required",
+            RequestId = command.RequestId,
+            SessionId = command.SessionId,
+            OauthRequestId = oauthRequestId,
+            AgentId = normalizedAgentId,
+            AgentName = normalizedAgentName,
+            ServerName = NormalizeOptionalString(requestData.ServerName) ?? string.Empty,
+            ServerUrl = NormalizeOptionalString(requestData.ServerUrl) ?? string.Empty,
+            StaticClientConfig = BuildStaticClientConfig(requestData.StaticClientConfig),
+        };
+    }
+
+    private static McpOauthStaticClientConfigDto? BuildStaticClientConfig(
+        McpOauthRequiredDataStaticClientConfig? staticClientConfig)
+    {
+        if (staticClientConfig is null)
+        {
+            return null;
+        }
+
+        return new McpOauthStaticClientConfigDto
+        {
+            ClientId = NormalizeOptionalString(staticClientConfig.ClientId) ?? string.Empty,
+            PublicClient = staticClientConfig.PublicClient,
+        };
+    }
+
+    private static string? NormalizeOptionalString(string? value)
+    {
+        return string.IsNullOrWhiteSpace(value) ? null : value.Trim();
+    }
+}

sidecar/src/Aryx.AgentHost/Services/CopilotTurnExecutionState.cs

@@ -9,6 +9,7 @@ internal sealed class CopilotTurnExecutionState
 {
     private readonly RunTurnCommandDto _command;
     private readonly HashSet<string> _startedAgents = new(StringComparer.OrdinalIgnoreCase);
+    private readonly ConcurrentQueue<McpOauthRequiredEventDto> _pendingMcpOauthRequests = new();
     private readonly ConcurrentDictionary<string, AgentIdentity> _observedAgentsByMessageId = new(StringComparer.Ordinal);
     private readonly StreamingTranscriptBuffer _transcriptBuffer = new();
     private int _fallbackMessageIndex;
@@ -76,6 +77,9 @@ internal sealed class CopilotTurnExecutionState
             case AssistantReasoningDeltaEvent:
                 ActiveAgent = agent;
                 break;
+            case McpOauthRequiredEvent:
+                ActiveAgent = agent;
+                break;
             case ExitPlanModeRequestedEvent:
                 HasPendingExitPlanModeRequest = true;
                 ActiveAgent = agent;
@@ -83,6 +87,23 @@ internal sealed class CopilotTurnExecutionState
         }
     }
 
+    public void EnqueuePendingMcpOauthRequest(McpOauthRequiredEventDto request)
+    {
+        ArgumentNullException.ThrowIfNull(request);
+        _pendingMcpOauthRequests.Enqueue(request);
+    }
+
+    public IReadOnlyList<McpOauthRequiredEventDto> DrainPendingMcpOauthRequests()
+    {
+        List<McpOauthRequiredEventDto> pending = [];
+        while (_pendingMcpOauthRequests.TryDequeue(out McpOauthRequiredEventDto? request))
+        {
+            pending.Add(request);
+        }
+
+        return pending;
+    }
+
     public bool TryResolveObservedAgentForMessage(string? messageId, out AgentIdentity agent)
     {
         agent = default;

sidecar/src/Aryx.AgentHost/Services/CopilotWorkflowRunner.cs

@@ -10,6 +10,7 @@ public sealed class CopilotWorkflowRunner : ITurnWorkflowRunner
     private readonly PatternValidator _patternValidator;
     private readonly CopilotApprovalCoordinator _approvalCoordinator = new();
     private readonly CopilotUserInputCoordinator _userInputCoordinator = new();
+    private readonly CopilotMcpOAuthCoordinator _mcpOAuthCoordinator = new();
     private readonly CopilotExitPlanModeCoordinator _exitPlanModeCoordinator = new();
 
     public CopilotWorkflowRunner(PatternValidator patternValidator)
@@ -23,6 +24,7 @@ public sealed class CopilotWorkflowRunner : ITurnWorkflowRunner
         Func<AgentActivityEventDto, Task> onActivity,
         Func<ApprovalRequestedEventDto, Task> onApproval,
         Func<UserInputRequestedEventDto, Task> onUserInput,
+        Func<McpOauthRequiredEventDto, Task> onMcpOAuthRequired,
         Func<ExitPlanModeRequestedEventDto, Task> onExitPlanMode,
         CancellationToken cancellationToken)
     {
@@ -58,6 +60,12 @@ public sealed class CopilotWorkflowRunner : ITurnWorkflowRunner
                 (agent, sessionEvent) =>
                 {
                     state.ObserveSessionEvent(agent, sessionEvent);
+                    if (sessionEvent is McpOauthRequiredEvent mcpOauthRequired)
+                    {
+                        state.EnqueuePendingMcpOauthRequest(
+                            _mcpOAuthCoordinator.BuildMcpOauthRequiredEvent(command, agent, mcpOauthRequired));
+                    }
+
                     if (sessionEvent is ExitPlanModeRequestedEvent exitPlanModeRequested)
                     {
                         _exitPlanModeCoordinator.RecordExitPlanModeRequest(command, agent, exitPlanModeRequested);
@@ -75,16 +83,19 @@ public sealed class CopilotWorkflowRunner : ITurnWorkflowRunner
             {
                 bool shouldEndTurn = await HandleWorkflowEventAsync(command, evt, inputMessages, state, onDelta, onActivity)
                     .ConfigureAwait(false);
+                await EmitPendingMcpOauthRequestsAsync(state, onMcpOAuthRequired).ConfigureAwait(false);
                 if (shouldEndTurn)
                 {
                     break;
                 }
             }
 
+            await EmitPendingMcpOauthRequestsAsync(state, onMcpOAuthRequired).ConfigureAwait(false);
             return state.FinalizeCompletedMessages();
         }
         catch (OperationCanceledException) when (runCancellation.IsCancellationRequested && !cancellationToken.IsCancellationRequested)
         {
+            await EmitPendingMcpOauthRequestsAsync(state, onMcpOAuthRequired).ConfigureAwait(false);
             ExitPlanModeRequestedEventDto? exitPlanModeEvent =
                 _exitPlanModeCoordinator.ConsumePendingRequest(command.RequestId);
             if (exitPlanModeEvent is null || !state.HasPendingExitPlanModeRequest)
@@ -97,6 +108,16 @@ public sealed class CopilotWorkflowRunner : ITurnWorkflowRunner
         }
     }
 
+    private static async Task EmitPendingMcpOauthRequestsAsync(
+        CopilotTurnExecutionState state,
+        Func<McpOauthRequiredEventDto, Task> onMcpOAuthRequired)
+    {
+        foreach (McpOauthRequiredEventDto request in state.DrainPendingMcpOauthRequests())
+        {
+            await onMcpOAuthRequired(request).ConfigureAwait(false);
+        }
+    }
+
     public Task ResolveApprovalAsync(
         ResolveApprovalCommandDto command,
         CancellationToken cancellationToken)

sidecar/src/Aryx.AgentHost/Services/ITurnWorkflowRunner.cs

@@ -10,6 +10,7 @@ public interface ITurnWorkflowRunner
         Func<AgentActivityEventDto, Task> onActivity,
         Func<ApprovalRequestedEventDto, Task> onApproval,
         Func<UserInputRequestedEventDto, Task> onUserInput,
+        Func<McpOauthRequiredEventDto, Task> onMcpOAuthRequired,
         Func<ExitPlanModeRequestedEventDto, Task> onExitPlanMode,
         CancellationToken cancellationToken);
 

sidecar/src/Aryx.AgentHost/Services/SidecarProtocolHost.cs

@@ -188,6 +188,7 @@ public sealed class SidecarProtocolHost
                     activity => WriteAsync(context.Output, activity, turnCancellation.Token),
                     approval => WriteAsync(context.Output, approval, turnCancellation.Token),
                     userInput => WriteAsync(context.Output, userInput, turnCancellation.Token),
+                    mcpOauth => WriteAsync(context.Output, mcpOauth, turnCancellation.Token),
                     exitPlanMode => WriteAsync(context.Output, exitPlanMode, turnCancellation.Token),
                     turnCancellation.Token)
                 .ConfigureAwait(false);