Merge pull request #173 from kernel/hypeship/sync-managed-auth-options

Sync MCP managed auth options

Author: masnwilliams

README.md

@@ -313,7 +313,7 @@ Call `get_connection_context` before deciding whether to create or select a proj
 - `manage_replays` - Start, stop, and list MP4 video replay recordings for a browser session. Session-scoped: start once, run your automation, then stop. Requires a paid Kernel plan.
 - `manage_extensions` - List and delete uploaded browser extensions.
 - `manage_apps` - List/search apps, invoke actions, get/list/delete deployments, and get invocation results.
-- `manage_auth_connections` - Create, list, get, delete, login, submit, and wait for managed-auth connections in every client. Use domain-filtered `list` for discovery. App-capable clients additionally receive `open_auth_login`; the programmatic actions remain available there too.
+- `manage_auth_connections` - Create, list, get, update, delete, login, submit, inspect timelines, and wait for managed-auth connections in every client. Supports health-check and automatic re-auth settings, managed-auth browser configuration, and canonical interaction-bound field/choice submissions. Use domain-filtered `list` for discovery. App-capable clients additionally receive `open_auth_login`; the programmatic actions remain available there too.
 - `manage_credentials` - Create, list, get, update, and delete stored credentials; fetch a current TOTP code for credentials with a configured totp_secret.
 - `manage_credential_providers` - Create, list, get, update, and delete external credential providers (e.g. 1Password); list available items and test the provider connection.
 
@@ -380,7 +380,7 @@ Returns: { success: true, result: "Example Domain" }
 
 Example: “Log me into my Hacker News account and update my profile to add a random emoji at the bottom.” The agent should discover `news.ycombinator.com`, open the App when needed, wait for authentication, then continue the profile edit without asking for credentials or a profile name in chat.
 
-The secure App defaults `record_session` and `browser_telemetry.enabled` to `true`, recording replay video plus the operational telemetry categories (`control`, `connection`, `system`, and `captcha`) for managed-auth browser sessions. Callers can explicitly disable either setting. The programmatic `manage_auth_connections` create/login actions preserve the API’s opt-in and inheritance behavior when these parameters are omitted.
+The secure App defaults `record_session` and `browser_telemetry.enabled` to `true`, recording replay video plus the operational telemetry categories (`control`, `connection`, `system`, and `captcha`) for managed-auth browser sessions. Callers can explicitly disable either setting. The programmatic `manage_auth_connections` create, update, and login actions pass browser telemetry through the API’s current nested `browser.telemetry` configuration while preserving defaults and inheritance when the MCP parameter is omitted.
 
 ### Set up browser profiles for authentication
 

bun.lock

@@ -39,8 +39,8 @@
     "@clerk/nextjs": "^7.7.1",
     "@clerk/themes": "^2.4.19",
     "@modelcontextprotocol/sdk": "1.26.0",
-    "@onkernel/managed-auth-react": "0.4.1",
-    "@onkernel/sdk": "^0.90.0",
+    "@onkernel/managed-auth-react": "0.5.1",
+    "@onkernel/sdk": "^0.97.0",
     "@posthog/mcp": "0.10.1",
     "@types/jsonwebtoken": "^9.0.10",
     "@types/redis": "^4.0.11",

package.json

@@ -4,7 +4,7 @@ import {
   isTerminalFailure,
 } from "@/lib/mcp/apps/managed-auth-terminal";
 
-// Mirrors the hosted UI (@onkernel/managed-auth-react 0.4.1): FAILED/CANCELED
+// Mirrors the hosted UI (@onkernel/managed-auth-react): FAILED/CANCELED
 // render StepError with the actual safe error code so ERROR_DISPLAY copy
 // survives; EXPIRED renders StepExpired.
 describe("managed-auth terminal view", () => {

src/lib/mcp/apps/generated/managed-auth-app.ts

@@ -108,6 +108,7 @@ describe("manage_apps invocation contract", () => {
                 created_at: "2026-08-08T00:00:00Z",
                 headless: false,
                 stealth: true,
+                memory: "2GiB",
                 timeout_seconds: 600,
                 region: "us-east",
               },

src/lib/mcp/apps/managed-auth-terminal.test.ts

@@ -25,6 +25,22 @@ export function connection(overrides: Partial<ManagedAuth> = {}): ManagedAuth {
     hosted_url: "https://managed-auth.onkernel.com/login/conn_1?code=secret",
     live_view_url: "https://live.example/secret",
     browser_session_id: "browser_secret",
+    interaction_id: "mai_secret",
+    fields: [
+      {
+        id: "field_password",
+        ref: "password",
+        type: "password",
+        reason: "missing",
+      },
+    ],
+    choices: [
+      {
+        id: "work-account",
+        label: "Work account",
+        type: "account",
+      },
+    ],
     discovered_fields: [
       {
         label: "Password",
@@ -129,6 +145,9 @@ const forbiddenKeys = [
   "jwt",
   "authorization",
   "credential",
+  "interaction_id",
+  "fields",
+  "choices",
   "discovered_fields",
   "mfa_options",
   "pending_sso_buttons",