feat: add built-in Workspace MCP connectors [risk:high]

[Leeeon233]

Risk: high | Confidence: high

Related issue

Internal same-repository change; no intake issue required.

Problem / pressure

Workspace MCP supports shared configuration, but users must manually discover provider endpoints and authentication details. Personal OAuth tokens and secret-bearing MCP URLs cannot safely live in the shared Workspace catalog.

Summary

Adds reviewed connector cards for Linear, Notion, Cloudflare, PostHog, and Feishu. Linear, Notion, Cloudflare, and PostHog use browser OAuth with discovery, PKCE, refresh, pinned provider boundaries, and bounded network behavior. Feishu uses guided personal-URL setup. Credentials are AES-GCM encrypted on the execution Machine and never enter Flock or Convex. Session startup resolves an authorized built-in preset into temporary ACP MCP headers. Canva and Slack remain excluded from this version.

Visual explanation

flowchart LR
  U[User] --> S[Workspace MCP settings]
  S -->|public preset only| F[(Workspace Flock)]
  S -->|same-Machine RPC| A[CLI auth service]
  A -->|OAuth + PKCE| B[System browser]
  B --> P[Provider]
  P -->|loopback callback| A
  A -->|AES-GCM token or secret URL| C[(Machine-local credential store)]
  T[Session startup] --> R[Session MCP resolver]
  F --> R
  C --> R
  R -->|temporary Authorization header| ACP[ACP Agent]

Loading

The trust boundary is intentional: shared catalog data identifies capability and policy, while personal authorization remains on the Machine that executes the Agent.

Before / after

Before	After
Users manually enter MCP endpoints and auth details.	Users select one of five reviewed provider cards.
Workspace catalog has no safe built-in auth lifecycle.	OAuth or guided setup is handled by the target CLI and stored locally.
Selected built-in entries cannot resolve credentials at session start.	The session resolver injects a temporary authorized HTTP MCP config or reports auth_required.

Test plan

• pnpm format
• pnpm check on the final rebased head: typecheck, lint with 0 errors, all repository tests, i18n, import guards, platform boundaries, and public boundary passed.
• pnpm run docs check
• Focused 38-test connector suite across CLI auth/credential/session resolution, shared schema, and components.
• Storybook rendered at 1440x900 and 390x844; the connector grid preserved actions, status labels, and responsive layout.
• Not run: live authorization against real provider accounts.

Context handoff

Instructions for reviewing agents

• Review focus: Audit workspace-mcp-auth-service.ts, workspace-mcp-credential-store.ts, and session resolution for OAuth redirect, token leakage, and deletion-winning race behavior.
• Decisions to challenge: Confirm that per-user per-Machine credentials and same-Machine loopback callbacks are the correct first-version trust and product boundary.
• Plausible failures / evidence gaps: Provider metadata may drift and live provider-account OAuth remains unverified despite deterministic discovery, redirect, refresh, and race tests.

Authoring context

• User goal / directives: Provide one-click Workspace MCP presets for Linear, Notion, Cloudflare, PostHog, and Feishu, prefer OAuth, exclude Canva and Slack, and avoid Convex.
• Constraints / non-goals: Do not synchronize provider credentials through Flock or a backend; remote callback relay and cross-Machine credential portability are out of scope.
• Risk-bearing decisions: Provider origins are allowlisted, OAuth uses PKCE and bounded discovery/redirects, PostHog write scopes are filtered, and credentials bind to user, Machine, provider, preset, and policy.
• Destructive or irreversible behavior: Disconnect and catalog removal delete local credentials; operations use serialization, generations, and compare-and-delete so removal wins races and stale callbacks cannot restore secrets.
• Deliberately not done or tested: Canva, Slack, remote OAuth relay, Convex credential storage, and live provider-account authorization are intentionally absent from this version.
• Unknowns / confidence: Confidence is high in local boundaries and deterministic tests; remaining uncertainty is real-provider metadata and consent behavior over time.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-09T03:51:07.559709Z	ed89238	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: ed89238480

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Default connector actions to the local machine

When users open the MCP tab normally, settingsSelectedMachineIdAtom is null: desktop tab navigation explicitly resets it in desktop-settings-modal.tsx, while the mobile MCP route mounts McpSetting directly, and this surface provides no machine selector or local-machine fallback. Consequently status polling is skipped and every OAuth/secret/test action reaches the localMachineRequired path, so built-in connectors cannot be authorized unless the atom happens to retain a machine from another settings flow. Default this to the current local machine or expose an explicit target selector.

AGENTS.md reference: packages/shared/AGENTS.md:L27-L30

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Negotiate support before sending the new Machine RPC

In a mixed-version installation where the renderer has this change but the local daemon has not yet been updated or restarted, canUseLocalMachineRpc proves only that the routing plane is local, after which this newly introduced method is sent unconditionally. No corresponding key/version was added to machine-protocol-capabilities.ts, so the older daemon rejects the request and all connector management fails rather than being reported as unsupported. Add and advertise a capability binding and check it before dispatching this RPC.

AGENTS.md reference: packages/shared/AGENTS.md:L9-L15

Useful? React with 👍 / 👎.