fix(mcp): match Seal's Agents-SDK callback path shape for cf-portal compatibility - #87
Merged
Merged
Conversation
…al compatibility)
Reading the Seal implementation (cloudflare/cto/seals) reveals the
canonical Agents-SDK callbackPath shape:
/agents/<kebab-class-name>/<instance-name>/callback
Seal uses `/agents/user-do/{userId}/callback` and successfully connects
to cf-portal. We were using `/agents/oauth/callback` (no instance name
in the path), which cf-portal rejected with:
Redirect URI not allowed by application configuration
cf-portal appears to validate redirect URI shape, requiring the
SDK-canonical pattern. Switch Dodo to
`/agents/coding-agent/{userEmail}/callback` to match. The path still
gets caught by `app.all("/agents/*")` so the existing dispatch logic
works unchanged — the Agents SDK's MCP callback handler picks up the
state param and routes to the correct DO storage.
userEmail is already canonicalized by the auth middleware (lowercased,
trimmed). Email chars (@ + .) are safe in URL paths per RFC 3986.
Tests: 817/817 pass. Typecheck clean.
beep-boop-🤖
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Discovery
After hitting
Redirect URI not allowed by application configurationfrom cf-portal, I checked how Seal (cloudflare/cto/seals) does it — Seal successfully connects to cf-portal in production.Seal's callback path (in
apps/seal/worker/objects/user/user-do.ts):Which resolves to
/agents/user-do/{userId}/callback. The shape matters — cf-portal validates redirect_uri against an expected OAuth-callback pattern and rejects anything non-canonical.We were using
/agents/oauth/callback(no per-instance segment). cf-portal said no.Fix
Switch to the Seal-pattern shape for Dodo:
callbackPath: `/agents/coding-agent/${userEmail}/callback`This is the Agents SDK's default
callbackUrltemplate fromMCPClientManager(see/agents/{kebab-class}/{name}/callbackin the SDK source)./agents/*Hono wildcard still catches it; the SDK's built-in MCP callback handler resolves state -> server -> token exchange unchanged.Why this is safe
userEmailis already lowercased + trimmed by the auth middleware.@and.are valid URL path chars per RFC 3986; no encoding needed.Verification
npm run typecheckcleannpx vitest run817/817 passbeep-boop-🤖