[ROB-2694] holmes-oauth

helm/robusta/values.yaml

@@ -97,6 +97,7 @@ lightActions:
 - holmes_conversation
 - holmes_issue_chat
 - holmes_chat
+- holmes_oauth
 - list_pods
 - kubectl_describe
 - fetch_resource_yaml

src/robusta/core/model/base_params.py

@@ -188,6 +188,7 @@ class ToolApprovalDecision(BaseModel):
     tool_call_id: str
     approved: bool
     save_prefixes: Optional[List[str]] = None  # Prefixes to remember for session
+    decision: Optional[Dict[str, Any]] = None  # Structured decision data (e.g. OAuth callback params). Parsed by Holmes.
 
 
 class HolmesChatParams(HolmesParams):
@@ -216,6 +217,21 @@ class HolmesIssueChatParams(HolmesChatParams):
     context: HolmesIssueChatParamsContext
 
 
+class HolmesOAuthParams(HolmesParams):
+    """
+    Forwards OAuth callback data to Holmes.
+    Params are intentionally generic (extra=allow) — the actual contract
+    is defined by Holmes and can evolve without runner changes.
+
+    :var toolset_name: The MCP toolset to authenticate
+    """
+
+    toolset_name: str
+
+    class Config:
+        extra = "allow"
+
+
 class HolmesConversationParams(HolmesParams):
     """
     :var resource: The resource related to this investigation. A resource has a `name` and `kind`, and may have `namespace` and `node`

src/robusta/core/playbooks/internal/ai_integration.py

@@ -12,6 +12,7 @@
     HolmesChatParams,
     HolmesConversationParams,
     HolmesIssueChatParams,
+    HolmesOAuthParams,
     ResourceInfo,
 )
 from robusta.core.model.events import ExecutionBaseEvent
@@ -385,6 +386,45 @@ def holmes_chat(event: ExecutionBaseEvent, params: HolmesChatParams):
         handle_holmes_error(e)
 
 
+@action
+def holmes_oauth(event: ExecutionBaseEvent, params: HolmesOAuthParams):
+    """
+    Forwards OAuth callback data to Holmes for token exchange and storage.
+
+    This action is a thin pass-through — the actual OAuth contract is defined
+    in Holmes. Params use extra=allow so Holmes can evolve the contract
+    (e.g. add new fields) without requiring runner changes.
+    """
+    holmes_url = HolmesDiscovery.find_holmes_url(params.holmes_url)
+    if not holmes_url:
+        raise ActionException(
+            ErrorCodes.HOLMES_DISCOVERY_FAILED,
+            "Robusta couldn't connect to the Holmes client.",
+        )
+
+    try:
+        params_dict = params.dict(exclude={"holmes_url", "model"})
+        result = requests.post(
+            f"{holmes_url}/api/oauth/callback",
+            json=params_dict,
+        )
+        result.raise_for_status()
+        response_data = result.json()
+
+        finding = Finding(
+            title="Holmes OAuth",
+            aggregation_key="HolmesOAuthResult",
+            subject=FindingSubject(subject_type=FindingSubjectType.TYPE_NONE),
+            finding_type=FindingType.AI_ANALYSIS,
+            failure=not response_data.get("success", False),
+        )
+        event.add_finding(finding)
+
+    except Exception as e:
+        logging.exception("Failed to complete Holmes OAuth callback")
+        handle_holmes_error(e)
+
+
 def stream_and_render_graphs(url, holmes_req, event):
     with requests.post(
         url,