Repository navigation
feat(loom): declare OAuth clients in the deployment manifest - #405
Merged
Merged
Conversation
deployment.reconcile accepts oauth_clients: public clients under stable, operator-chosen ids, so a stack can register the claude.ai connector before anyone enters its id. Reconciling updates a declared client in place and keeps people's grants; a pruning reconcile removes clients the stack stopped declaring and revokes what they were issued. A declaration never takes over a client an administrator registered by hand.
This was referenced Oct 22, 2026
rjpower
added a commit
to marin-community/marin
that referenced
this pull request
Oct 22, 2026
The marin-loom stack now declares the remote MCP connector's OAuth clients under `oauthClients`. Activation passes them to Loom's `deployment.reconcile` as `oauth_clients`, so nobody has to run `loom oauth-client add` by hand. - `claude-ai` accepts claude.ai's callback on both `claude.ai` and `claude.com`. - `claude-code` accepts Claude Code's loopback callback on any port. Both are public clients that prove themselves with PKCE, so the stack carries no secret. In claude.ai the connector takes client ID `claude-ai` with a blank secret. claude.ai cannot change a connector's OAuth settings after it is added, so these ids must never be renamed. Because the stack prunes, removing a client from it revokes every token the client was issued. The README's connector section describes this instead of manual registration. Depends on marin-community/loom#405. Loom builds without that change ignore `oauth_clients`, so this config deploys cleanly before it lands but registers nothing until Loom has the support. Co-authored-by: rjpower <rjpower@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
deployment.reconcilegains anoauth_clientslist, so a deployment stack can declare the remote MCP connector's OAuth clients instead of an administrator registering them by hand withloom oauth-client add..,_,-), so people can enter it in claude.ai orclaude mcp add --client-idbefore the first deploy. claude.ai cannot change a connector's OAuth settings after it is added, so the id must not change between deploys.oauth_clients.managed_by_deployment. Reconciling updates a declared client's name and redirect URIs in place and keeps existing grants. A pruning reconcile removes declared clients the stack no longer lists and revokes their tokens. Declaring the id of a hand-registered client returns409before anything is applied, so a manifest cannot take over or downgrade a confidential client.OAuthClientViewgainsdeployment_managed, andDeploymentViewreturns the declared clients.The connector docs (README,
docs/configuration.md,docs/ARCHITECTURE.md) now lead with the manifest declaration. A companion Marin change declaresclaude-aiin themarin-loomstack.