ryu-workflows v0.4.0

Highlights

Passport-owned workflow bindings, MCP OAuth, vault-backed tools, credential grants, scoped discovery, and agent-bound runtime metadata

Workflows can now bind to connections owned by Passport, so triggers are authorized against identities held by the standalone Passport service rather than credentials held by the caller. The bindings are configured from the workflows plugin UI itself; new ConnectWorkflowBindings components and hooks in the workflows plugin expose Passport-owned targets to the trigger configuration screen. Core carries the workflow UI fixture and manifest entries, the desktop plugin host panel and workflow-connect API client consume them, and the mobile plugin mount renders the same plugin UI.

Users can connect authenticated MCP extensions using OAuth credentials scoped to a Passport identity. Ryu Passport now owns the OAuth lifecycle and transport for these MCP connections so credentials are not shared across identities. The core sidecar MCP client delegates OAuth handling to Passport, ryu-vault provides the OAuth, SSE, and transport modules, and documentation for authenticated MCP extensions and the Passport API describes the scoped flow, with tests covering core handoff and core MCP OAuth behavior in ryu-passport.

Affected packages: @ryu/workflows

Changelog

@ryu/workflows@0.4.0

Minor changes

• Added ConnectWorkflowBindings components and hooks so the workflows UI and trigger configuration can bind Passport-owned connections. (d3d2e23)

Patch changes

• Updated the workflows UI, touching trigger configuration and version history components in TriggerConfig.tsx and VersionHistory.tsx. (fd3adbf)
• Scoped recording and run status lifetimes in the workflows UI so App.tsx, WorkflowCanvas.tsx and hooks.ts release them rather than holding them indefinitely. (ae88a3a)

Full changelog: amajorai/ryu@v0.3.1...v0.4.0