@akira-tl/forgerelay 0.5.6 → 0.6.0

package/dist/server.js

@@ -6,7 +6,7 @@ import { resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { McpServer, ResourceTemplate } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { createMcpExpressApp } from "@modelcontextprotocol/sdk/server/express.js";
-import { mcpAuthRouter, getOAuthProtectedResourceMetadataUrl } from "@modelcontextprotocol/sdk/server/auth/router.js";
+import { getOAuthProtectedResourceMetadataUrl } from "@modelcontextprotocol/sdk/server/auth/router.js";
 import { requireBearerAuth } from "@modelcontextprotocol/sdk/server/auth/middleware/bearerAuth.js";
 import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
 import { isInitializeRequest } from "@modelcontextprotocol/sdk/types.js";
@@ -36,6 +36,8 @@ import { createOpenAIIncomingArtifactAdapter, IncomingArtifactAdapterRegistry, }
 import { logEvent, requestIp, requestPath, commandPreview, transportSessionIdPrefix, workspaceLogLabel, } from "./logger.js";
 import { editFileTool, readFileTool, writeFileTool, } from "./pi-tools.js";
 import { SingleUserOAuthProvider } from "./oauth-provider.js";
+import { createForgeRelayAuthRouter } from "./oauth/router.js";
+import { publicEndpointUrl } from "./oauth/public-url.js";
 import { BatchExecutor } from "./operations/batch/executor.js";
 import { executeBulkRead } from "./operations/bulk-read.js";
 import { NativeBulkMutationExecutor } from "./operations/native-bulk-mutations.js";
@@ -43,8 +45,8 @@ import { createCoreOperationExecutor, } from "./operations/core-operation-execut
 import { McpTransportRegistry, } from "./mcp-sessions.js";
 import { ProcessManager, resolveProcessId, } from "./process-sessions.js";
 import { createReviewCheckpointManager } from "./review-checkpoints.js";
-import { openAiConversationScopeId } from "./request-meta.js";
-import { readWorkspaceAppManifestEntry, resolveWorkspaceAppIdentity, WORKSPACE_APP_LEGACY_URI, WORKSPACE_APP_URI_TEMPLATE, } from "./mcp-app-template.js";
+import { hostConversationScopeId, openAiConversationScopeId } from "./request-meta.js";
+import { ACTIVITY_PANEL_APP_LEGACY_URI, ACTIVITY_PANEL_APP_URI_TEMPLATE, MCP_APP_RESOURCE_TEMPLATE_REVISION, readActivityPanelAppManifestEntry, readWorkspaceAppManifestEntry, readWorkspaceLifecycleAppManifestEntry, resolveActivityPanelAppIdentity, resolveWorkspaceAppIdentity, resolveWorkspaceLifecycleAppIdentity, WORKSPACE_APP_LEGACY_URI, WORKSPACE_APP_URI_TEMPLATE, WORKSPACE_LIFECYCLE_APP_LEGACY_URI, WORKSPACE_LIFECYCLE_APP_URI_TEMPLATE, } from "./mcp-app-template.js";
 import { shutdownHttpServer } from "./server-shutdown.js";
 import { formatPathForPrompt } from "./skills.js";
 import { createWorkspaceStore } from "./workspace-store.js";
@@ -77,26 +79,22 @@ const SHELL_TOOL_ANNOTATIONS = {
     openWorldHint: true,
 };
 function shouldAttachWidget(mode, kind) {
-    switch (mode) {
-        case "off":
-            return false;
-        case "changes":
-            return kind === "workspace" || kind === "capability";
-        case "full":
-            return true;
-    }
+    if (mode === "off")
+        return false;
+    return kind === "activity";
 }
 function toolWidgetDescriptorMeta(config, kind) {
     if (!shouldAttachWidget(config.widgets, kind))
         return { _meta: {} };
-    const resourceUri = currentWorkspaceAppIdentity().uri;
+    const resourceUri = kind === "activity"
+        ? currentActivityPanelAppIdentity(config).uri
+        : currentWorkspaceLifecycleAppIdentity(config).uri;
     return {
         _meta: {
             ui: {
                 resourceUri,
                 visibility: ["model", "app"],
             },
-            "openai/outputTemplate": resourceUri,
         },
     };
 }
@@ -152,8 +150,40 @@ function resultOutputSchema(extra = {}) {
 const workspaceSkillOutputSchema = z.object({
     name: z.string(),
     description: z.string(),
-    path: z.string(),
 });
+const workspaceSkillDiagnosticOutputSchema = z.object({
+    type: z.enum(["warning", "error", "collision"]),
+    message: z.string(),
+    collision: z.object({
+        resourceType: z.enum(["extension", "skill", "prompt", "theme"]),
+        name: z.string(),
+    }).optional(),
+});
+function redactSkillDiagnosticPaths(diagnostics) {
+    return diagnostics.map((diagnostic) => {
+        let message = diagnostic.message;
+        const hiddenPaths = [
+            diagnostic.path,
+            diagnostic.collision?.winnerPath,
+            diagnostic.collision?.loserPath,
+        ].filter((path) => Boolean(path));
+        for (const path of hiddenPaths) {
+            message = message.split(path).join("<skill-path>");
+        }
+        return {
+            type: diagnostic.type,
+            message,
+            ...(diagnostic.collision
+                ? {
+                    collision: {
+                        resourceType: diagnostic.collision.resourceType,
+                        name: diagnostic.collision.name,
+                    },
+                }
+                : {}),
+        };
+    });
+}
 const capabilityFingerprintOutputSchema = z.object({
     version: z.string(),
     toolMode: z.enum(["minimal", "full", "codex"]),
@@ -270,6 +300,10 @@ function mcpRequestDebugFields(body) {
     const params = request.params && typeof request.params === "object" && !Array.isArray(request.params)
         ? request.params
         : undefined;
+    const rpcMeta = params?._meta && typeof params._meta === "object" && !Array.isArray(params._meta)
+        ? params._meta
+        : undefined;
+    const rpcMetaKeys = rpcMeta ? Object.keys(rpcMeta).sort() : [];
     let rpcTarget;
     if (rpcMethod === "resources/read" && typeof params?.uri === "string") {
         rpcTarget = params.uri;
@@ -277,7 +311,11 @@ function mcpRequestDebugFields(body) {
     else if (rpcMethod === "tools/call" && typeof params?.name === "string") {
         rpcTarget = params.name;
     }
-    return { rpcMethod, rpcTarget };
+    return {
+        rpcMethod,
+        rpcTarget,
+        ...(rpcMetaKeys.length > 0 ? { rpcMetaKeys } : {}),
+    };
 }
 function logToolCall(config, fields) {
     if (!config.logging.toolCalls)
@@ -368,24 +406,64 @@ function uiManifestUrl() {
 function uiBuildDirectoryUrl() {
     return new URL("../dist/ui/", import.meta.url);
 }
-let cachedWorkspaceAppIdentity;
-function currentWorkspaceAppIdentity() {
-    cachedWorkspaceAppIdentity ??= resolveWorkspaceAppIdentity({
+const cachedWorkspaceAppIdentities = new Map();
+const cachedWorkspaceLifecycleAppIdentities = new Map();
+const cachedActivityPanelAppIdentities = new Map();
+function appResourceContractRevision(config) {
+    return [
+        MCP_APP_RESOURCE_TEMPLATE_REVISION,
+        `publicBaseUrls=${JSON.stringify(config.publicBaseUrls)}`,
+    ].join("\0");
+}
+function appIdentityOptions(config) {
+    return {
         manifestUrl: uiManifestUrl(),
         buildDirectoryUrl: uiBuildDirectoryUrl(),
         fallbackRevision: FORGERELAY_VERSION,
-    });
-    return cachedWorkspaceAppIdentity;
+        resourceTemplateRevision: appResourceContractRevision(config),
+    };
+}
+function currentWorkspaceAppIdentity(config) {
+    const key = appResourceContractRevision(config);
+    let identity = cachedWorkspaceAppIdentities.get(key);
+    if (!identity) {
+        identity = resolveWorkspaceAppIdentity(appIdentityOptions(config));
+        cachedWorkspaceAppIdentities.set(key, identity);
+    }
+    return identity;
+}
+function currentWorkspaceLifecycleAppIdentity(config) {
+    const key = appResourceContractRevision(config);
+    let identity = cachedWorkspaceLifecycleAppIdentities.get(key);
+    if (!identity) {
+        identity = resolveWorkspaceLifecycleAppIdentity(appIdentityOptions(config));
+        cachedWorkspaceLifecycleAppIdentities.set(key, identity);
+    }
+    return identity;
+}
+function currentActivityPanelAppIdentity(config) {
+    const key = appResourceContractRevision(config);
+    let identity = cachedActivityPanelAppIdentities.get(key);
+    if (!identity) {
+        identity = resolveActivityPanelAppIdentity(appIdentityOptions(config));
+        cachedActivityPanelAppIdentities.set(key, identity);
+    }
+    return identity;
 }
 function getWorkspaceAppManifestEntry() {
     return readWorkspaceAppManifestEntry(uiManifestUrl());
 }
+function getWorkspaceLifecycleAppManifestEntry() {
+    return readWorkspaceLifecycleAppManifestEntry(uiManifestUrl());
+}
+function getActivityPanelAppManifestEntry() {
+    return readActivityPanelAppManifestEntry(uiManifestUrl());
+}
 function assetUrl(baseUrl, assetPath) {
     return `${baseUrl}/${assetPath.replace(/^\/+/, "")}`;
 }
-function workspaceAppHtml(config) {
+function mcpAppHtml(config, entry, title, waitingMessage) {
     const baseUrl = assetBaseUrl(config);
-    const entry = getWorkspaceAppManifestEntry();
     const stylesheets = (entry.css ?? [])
         .map((stylesheet) => `    <link rel="stylesheet" crossorigin href="${assetUrl(baseUrl, stylesheet)}" />`)
         .join("\n");
@@ -394,25 +472,33 @@ function workspaceAppHtml(config) {
   <head>
     <meta charset="UTF-8" />
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
-    <title>ForgeRelay Workspace</title>
+    <title>${title}</title>
     <script type="module" crossorigin src="${assetUrl(baseUrl, entry.file)}"></script>
 ${stylesheets}
   </head>
   <body>
     <main id="app" class="shell">
-      <section class="empty">Waiting for a tool result.</section>
+      <section class="empty">${waitingMessage}</section>
     </main>
   </body>
 </html>`;
 }
+function workspaceAppHtml(config) {
+    return mcpAppHtml(config, getWorkspaceAppManifestEntry(), "ForgeRelay Workspace", "Waiting for a workspace result.");
+}
+function workspaceLifecycleAppHtml(config) {
+    return mcpAppHtml(config, getWorkspaceLifecycleAppManifestEntry(), "ForgeRelay Workspace Lifecycle", "Waiting for a workspace result.");
+}
+function activityPanelAppHtml(config) {
+    return mcpAppHtml(config, getActivityPanelAppManifestEntry(), "ForgeRelay Activity Panel", "Waiting for Activity Panel state.");
+}
 function appDomain(config) {
     return new URL(config.publicBaseUrl).origin;
 }
 function appCsp(config) {
-    const publicBaseUrl = config.publicBaseUrl.replace(/\/+$/, "");
     return {
-        resourceDomains: [publicBaseUrl],
-        connectDomains: [publicBaseUrl],
+        resourceDomains: [...config.publicBaseUrls],
+        connectDomains: [...config.publicBaseUrls],
     };
 }
 function uiBuildDirectory() {
@@ -424,59 +510,89 @@ function setAssetHeaders(res) {
     res.setHeader("Access-Control-Allow-Headers", "Content-Type, Range");
     res.setHeader("Cross-Origin-Resource-Policy", "cross-origin");
 }
-async function assertWorkspaceAppAssets() {
-    const entry = getWorkspaceAppManifestEntry();
+async function assertMcpAppAssets(entry) {
     const candidates = [entry.file, ...(entry.css ?? [])].map((assetPath) => new URL(`../dist/ui/${assetPath}`, import.meta.url));
-    for (const candidate of candidates) {
+    for (const candidate of candidates)
         await access(candidate);
-    }
 }
-function workspaceAppCompatibilityKind(requestedUri, currentUri) {
+function appResourceVariant(requestedUri, currentUri, legacyUri) {
     if (requestedUri === currentUri)
         return "current";
-    if (requestedUri === WORKSPACE_APP_LEGACY_URI)
+    if (requestedUri === legacyUri)
         return "legacy";
     return "historical";
 }
-async function readWorkspaceAppResource(config, requestedUri, transportSessionId) {
-    const currentUri = currentWorkspaceAppIdentity().uri;
-    const compatibility = workspaceAppCompatibilityKind(requestedUri, currentUri);
+async function readMcpAppResource(config, options) {
+    const compatibility = appResourceVariant(options.requestedUri, options.currentUri, options.legacyUri);
     try {
-        await assertWorkspaceAppAssets();
+        await assertMcpAppAssets(options.entry);
         const result = {
-            contents: [
-                {
-                    uri: requestedUri,
+            contents: [{
+                    uri: options.requestedUri,
                     mimeType: RESOURCE_MIME_TYPE,
-                    text: workspaceAppHtml(config),
+                    text: options.html,
                     _meta: {
                         ui: {
                             domain: appDomain(config),
                             csp: appCsp(config),
                         },
+                        // MCP Apps defines resource metadata under `_meta.ui`. Inspector 2.3.0
+                        // reads the content-item CSP/domain from `_meta` directly, so mirror
+                        // these values until that installed-host compatibility gap is gone.
+                        domain: appDomain(config),
+                        csp: appCsp(config),
                     },
-                },
-            ],
+                }],
         };
         logEvent(config.logging, "debug", "mcp_app_template_read", {
-            requestedUri,
-            currentUri,
+            requestedUri: options.requestedUri,
+            currentUri: options.currentUri,
             compatibility,
-            transportSessionIdPrefix: transportSessionIdPrefix(transportSessionId),
+            transportSessionIdPrefix: transportSessionIdPrefix(options.transportSessionId),
         });
         return result;
     }
     catch (error) {
         logEvent(config.logging, "warn", "mcp_app_template_read_failed", {
-            requestedUri,
-            currentUri,
+            requestedUri: options.requestedUri,
+            currentUri: options.currentUri,
             compatibility,
             error: error instanceof Error ? error.message : String(error),
-            transportSessionIdPrefix: transportSessionIdPrefix(transportSessionId),
+            transportSessionIdPrefix: transportSessionIdPrefix(options.transportSessionId),
         });
         throw error;
     }
 }
+function readWorkspaceAppResource(config, requestedUri, transportSessionId, currentUri = currentWorkspaceAppIdentity(config).uri, legacyUri = WORKSPACE_APP_LEGACY_URI) {
+    return readMcpAppResource(config, {
+        requestedUri,
+        currentUri,
+        legacyUri,
+        entry: getWorkspaceAppManifestEntry(),
+        html: workspaceAppHtml(config),
+        transportSessionId,
+    });
+}
+function readWorkspaceLifecycleAppResource(config, requestedUri, transportSessionId) {
+    return readMcpAppResource(config, {
+        requestedUri,
+        currentUri: currentWorkspaceLifecycleAppIdentity(config).uri,
+        legacyUri: WORKSPACE_LIFECYCLE_APP_LEGACY_URI,
+        entry: getWorkspaceLifecycleAppManifestEntry(),
+        html: workspaceLifecycleAppHtml(config),
+        transportSessionId,
+    });
+}
+function readActivityPanelAppResource(config, requestedUri, transportSessionId) {
+    return readMcpAppResource(config, {
+        requestedUri,
+        currentUri: currentActivityPanelAppIdentity(config).uri,
+        legacyUri: ACTIVITY_PANEL_APP_LEGACY_URI,
+        entry: getActivityPanelAppManifestEntry(),
+        html: activityPanelAppHtml(config),
+        transportSessionId,
+    });
+}
 const PROCESS_RESPONSE_OUTPUT_LINES = 10;
 function compactProcessOutput(output) {
     if (!output)
@@ -839,19 +955,19 @@ function activityRelationFor(context) {
         ...(context.turnId ? { turnId: context.turnId } : {}),
     };
 }
-function runActivityTool(lifecycle, workspace, requestMeta, tool, request, operation, outcome = standardActivityOutcome, relation = {}) {
+function runActivityTool(lifecycle, workspace, conversationScopeId, tool, request, operation, outcome = standardActivityOutcome, relation = {}) {
     return lifecycle.run({
         tool,
         workspace: workspaceActivitySnapshot(workspace),
-        conversationScopeId: openAiConversationScopeId(requestMeta),
+        conversationScopeId,
         request,
         operation,
         outcome,
         ...relation,
     });
 }
-function runActivityToolWithHooks(lifecycle, hooks, workspace, requestMeta, request, hookOptions, relation = {}) {
-    return runActivityTool(lifecycle, workspace, requestMeta, hookOptions.tool, request, () => runToolWithHooks(hooks, hookOptions), standardActivityOutcome, relation);
+function runActivityToolWithHooks(lifecycle, hooks, workspace, conversationScopeId, request, hookOptions, relation = {}) {
+    return runActivityTool(lifecycle, workspace, conversationScopeId, hookOptions.tool, request, () => runToolWithHooks(hooks, hookOptions), standardActivityOutcome, relation);
 }
 function registerProcessTools(server, config, workspaces, processSessions, hooks, activityLifecycle, bashOutputStore, shellRun) {
     if (config.toolMode === "codex") {
@@ -1007,6 +1123,8 @@ function registerProcessTools(server, config, workspaces, processSessions, hooks
     });
 }
 export function createMcpServer(config, workspaces, reviewCheckpoints, processSessions, localAgentProviders, incomingArtifactAdapters, codeIntelligence, activityLifecycle, bashOutputStore, activityQueries) {
+    const connectionScopeId = `mcp-connection:${randomUUID()}`;
+    const hostScopeIdFor = (requestMeta, transportSessionId) => hostConversationScopeId(requestMeta, transportSessionId, connectionScopeId);
     const toolDescriptions = buildToolDescriptions(config);
     const hooks = new HookRunner(config.hooks, config.logging, process.env, (workspaceId, result) => attachCompletedProcessNotices(processSessions, workspaceId, result, (snapshot) => recordBashCompletion(activityLifecycle, bashOutputStore, snapshot.outputId)));
     const incomingArtifactRegistry = new IncomingArtifactAdapterRegistry(incomingArtifactAdapters);
@@ -1108,7 +1226,7 @@ export function createMcpServer(config, workspaces, reviewCheckpoints, processSe
         read: async (input, context) => {
             const { workspaceId, ...readInput } = input;
             const workspace = workspaces.getWorkspace(workspaceId);
-            return runActivityToolWithHooks(activityLifecycle, hooks, workspace, context.requestMeta, input, {
+            return runActivityToolWithHooks(activityLifecycle, hooks, workspace, hostScopeIdFor(context.requestMeta, context.sessionId), input, {
                 signal: context.signal,
                 tool: toolNames.read,
                 invocation: workspaceHookInvocation(workspace),
@@ -1180,7 +1298,7 @@ export function createMcpServer(config, workspaces, reviewCheckpoints, processSe
         write: async (input, context) => {
             const { workspaceId, ...writeInput } = input;
             const workspace = workspaces.getWorkspace(workspaceId);
-            return runActivityToolWithHooks(activityLifecycle, hooks, workspace, context.requestMeta, input, {
+            return runActivityToolWithHooks(activityLifecycle, hooks, workspace, hostScopeIdFor(context.requestMeta, context.sessionId), input, {
                 signal: context.signal,
                 tool: toolNames.write,
                 invocation: workspaceHookInvocation(workspace),
@@ -1241,7 +1359,7 @@ export function createMcpServer(config, workspaces, reviewCheckpoints, processSe
         edit: async (input, context) => {
             const { workspaceId, ...editInput } = input;
             const workspace = workspaces.getWorkspace(workspaceId);
-            return runActivityToolWithHooks(activityLifecycle, hooks, workspace, context.requestMeta, input, {
+            return runActivityToolWithHooks(activityLifecycle, hooks, workspace, hostScopeIdFor(context.requestMeta, context.sessionId), input, {
                 signal: context.signal,
                 tool: toolNames.edit,
                 invocation: workspaceHookInvocation(workspace),
@@ -1303,7 +1421,7 @@ export function createMcpServer(config, workspaces, reviewCheckpoints, processSe
         rename: async (input, context) => {
             const { workspaceId, path, newPath } = input;
             const workspace = workspaces.getWorkspace(workspaceId);
-            return runActivityToolWithHooks(activityLifecycle, hooks, workspace, context.requestMeta, input, {
+            return runActivityToolWithHooks(activityLifecycle, hooks, workspace, hostScopeIdFor(context.requestMeta, context.sessionId), input, {
                 signal: context.signal,
                 tool: toolNames.rename,
                 invocation: workspaceHookInvocation(workspace),
@@ -1362,7 +1480,7 @@ export function createMcpServer(config, workspaces, reviewCheckpoints, processSe
         delete: async (input, context) => {
             const { workspaceId, path, recursive } = input;
             const workspace = workspaces.getWorkspace(workspaceId);
-            return runActivityToolWithHooks(activityLifecycle, hooks, workspace, context.requestMeta, input, {
+            return runActivityToolWithHooks(activityLifecycle, hooks, workspace, hostScopeIdFor(context.requestMeta, context.sessionId), input, {
                 signal: context.signal,
                 tool: toolNames.delete,
                 invocation: workspaceHookInvocation(workspace),
@@ -1446,7 +1564,7 @@ export function createMcpServer(config, workspaces, reviewCheckpoints, processSe
                     maxOutputTokens,
                 };
             let undeliveredProcessId;
-            const activityResult = await runActivityTool(activityLifecycle, workspace, context.requestMeta, surface, activityRequest, async (activityContext) => {
+            const activityResult = await runActivityTool(activityLifecycle, workspace, hostScopeIdFor(context.requestMeta, context.sessionId), surface, activityRequest, async (activityContext) => {
                 try {
                     const result = await runToolWithHooks(hooks, {
                         signal: context.signal,
@@ -1520,7 +1638,7 @@ export function createMcpServer(config, workspaces, reviewCheckpoints, processSe
             const { workspaceId, name, arguments: capabilityArguments, file } = input;
             const workspace = workspaces.getWorkspace(workspaceId);
             let changedPaths = [];
-            return runActivityToolWithHooks(activityLifecycle, hooks, workspace, context.requestMeta, { workspaceId, name, action: "run", arguments: capabilityArguments, file }, {
+            return runActivityToolWithHooks(activityLifecycle, hooks, workspace, hostScopeIdFor(context.requestMeta, context.sessionId), { workspaceId, name, action: "run", arguments: capabilityArguments, file }, {
                 signal: context.signal,
                 tool: toolNames.capability,
                 invocation: workspaceHookInvocation(workspace),
@@ -1616,9 +1734,18 @@ export function createMcpServer(config, workspaces, reviewCheckpoints, processSe
     }, {
         instructions: buildServerInstructions(config),
     });
-    const currentWorkspaceAppUri = currentWorkspaceAppIdentity().uri;
+    const workspacePanelStates = new Map();
+    const rememberWorkspacePanelState = (workspaceId, response) => {
+        if (typeof response._meta !== "object" || response._meta === null)
+            return;
+        const meta = response._meta;
+        const card = meta.card;
+        if (meta.tool !== toolNames.openWorkspace || typeof card !== "object" || card === null)
+            return;
+        workspacePanelStates.set(workspaceId, card);
+    };
     const workspaceAppResourceMetadata = {
-        description: "Interactive card for viewing ForgeRelay file diffs.",
+        description: "Historical ForgeRelay tool card UI.",
         _meta: {
             ui: {
                 domain: appDomain(config),
@@ -1626,12 +1753,23 @@ export function createMcpServer(config, workspaces, reviewCheckpoints, processSe
             },
         },
     };
-    registerAppResource(server, "ForgeRelay Diff Card", currentWorkspaceAppUri, workspaceAppResourceMetadata, async (uri, extra) => readWorkspaceAppResource(config, uri.toString(), extra.sessionId));
-    registerAppResource(server, "ForgeRelay Diff Card legacy", WORKSPACE_APP_LEGACY_URI, workspaceAppResourceMetadata, async (uri, extra) => readWorkspaceAppResource(config, uri.toString(), extra.sessionId));
-    server.registerResource("ForgeRelay Diff Card compatibility", new ResourceTemplate(WORKSPACE_APP_URI_TEMPLATE, { list: undefined }), {
-        ...workspaceAppResourceMetadata,
-        mimeType: RESOURCE_MIME_TYPE,
-    }, async (uri, _variables, extra) => readWorkspaceAppResource(config, uri.toString(), extra.sessionId));
+    const workspaceLifecycleResourceMetadata = {
+        description: "Historical ForgeRelay Workspace lifecycle UI compatibility resource.",
+        _meta: workspaceAppResourceMetadata._meta,
+    };
+    const activityPanelResourceMetadata = {
+        description: "ForgeRelay unified Workspace and Activity UI for one Host Turn.",
+        _meta: workspaceAppResourceMetadata._meta,
+    };
+    const currentWorkspaceAppUri = currentWorkspaceAppIdentity(config).uri;
+    registerAppResource(server, "ForgeRelay historical tool card", currentWorkspaceAppUri, workspaceAppResourceMetadata, async (uri, extra) => readWorkspaceAppResource(config, uri.toString(), extra.sessionId));
+    registerAppResource(server, "ForgeRelay historical tool card legacy", WORKSPACE_APP_LEGACY_URI, workspaceAppResourceMetadata, async (uri, extra) => readWorkspaceAppResource(config, uri.toString(), extra.sessionId));
+    server.registerResource("ForgeRelay historical tool card compatibility", new ResourceTemplate(WORKSPACE_APP_URI_TEMPLATE, { list: undefined }), { ...workspaceAppResourceMetadata, mimeType: RESOURCE_MIME_TYPE }, async (uri, _variables, extra) => readWorkspaceAppResource(config, uri.toString(), extra.sessionId));
+    server.registerResource("ForgeRelay historical Workspace Lifecycle compatibility", new ResourceTemplate(WORKSPACE_LIFECYCLE_APP_URI_TEMPLATE, { list: undefined }), { ...workspaceLifecycleResourceMetadata, mimeType: RESOURCE_MIME_TYPE }, async (uri, _variables, extra) => readWorkspaceLifecycleAppResource(config, uri.toString(), extra.sessionId));
+    const currentActivityPanelAppUri = currentActivityPanelAppIdentity(config).uri;
+    registerAppResource(server, "ForgeRelay Activity Panel", currentActivityPanelAppUri, activityPanelResourceMetadata, async (uri, extra) => readActivityPanelAppResource(config, uri.toString(), extra.sessionId));
+    registerAppResource(server, "ForgeRelay Activity Panel legacy", ACTIVITY_PANEL_APP_LEGACY_URI, activityPanelResourceMetadata, async (uri, extra) => readActivityPanelAppResource(config, uri.toString(), extra.sessionId));
+    server.registerResource("ForgeRelay Activity Panel compatibility", new ResourceTemplate(ACTIVITY_PANEL_APP_URI_TEMPLATE, { list: undefined }), { ...activityPanelResourceMetadata, mimeType: RESOURCE_MIME_TYPE }, async (uri, _variables, extra) => readActivityPanelAppResource(config, uri.toString(), extra.sessionId));
     registerAppTool(server, "open_workspace", {
         title: "Open workspace",
         description: "Open or resume a local coding workspace. Reuse the returned workspaceId for later calls. Default to checkout; use mode=\"worktree\" only when the user explicitly requests isolated or parallel Git work. Every call returns lightweight workspace metadata; bootstrap context is delivered automatically only when needed and can be explicitly suppressed or refreshed.",
@@ -1745,13 +1883,13 @@ export function createMcpServer(config, workspaces, reviewCheckpoints, processSe
             skills: z.array(workspaceSkillOutputSchema).optional(),
             agentProviders: z.array(workspaceLocalAgentProviderOutputSchema).optional(),
             agents: z.array(workspaceLocalAgentOutputSchema).optional(),
-            skillDiagnostics: z.array(z.unknown()).optional(),
+            skillDiagnostics: z.array(workspaceSkillDiagnosticOutputSchema).optional(),
             workspaces: z.array(workspaceInventoryEntryOutputSchema).optional(),
             summary: workspaceInventorySummaryOutputSchema.optional(),
             page: workspaceInventoryPageOutputSchema.optional(),
             instruction: z.string(),
         },
-        ...toolWidgetDescriptorMeta(config, "workspace"),
+        _meta: {},
         annotations: {
             readOnlyHint: false,
             destructiveHint: false,
@@ -1831,7 +1969,6 @@ export function createMcpServer(config, workspaces, reviewCheckpoints, processSe
             .map((skill) => ({
             name: skill.name,
             description: skill.description,
-            path: formatPathForPrompt(skill.filePath),
         }));
         const capabilityGuides = workspace.capabilityGuides.map((guide) => ({
             name: guide.name,
@@ -1858,6 +1995,9 @@ export function createMcpServer(config, workspaces, reviewCheckpoints, processSe
             path: formatAgentsPath(file.path, workspace.root),
         }));
         const visibleSkills = includeBootstrapContext ? cardSkills : [];
+        const visibleSkillDiagnostics = includeBootstrapContext
+            ? redactSkillDiagnosticPaths(workspace.skillDiagnostics)
+            : [];
         const visibleCapabilityGuides = includeBootstrapContext ? capabilityGuides : [];
         const visibleAgentProviders = includeBootstrapContext ? cardAgentProviders : [];
         const visibleAgents = includeBootstrapContext ? cardAgents : [];
@@ -1866,7 +2006,7 @@ export function createMcpServer(config, workspaces, reviewCheckpoints, processSe
         const workspaceContextInstruction = "For later open_workspace calls, context=\"auto\" avoids repeating unchanged bootstrap context; use context=\"none\" when only the workspace handle/metadata is needed, or context=\"full\" to force a refresh.";
         const workspaceManagementInstruction = "When you need to continue an earlier logical workspace or organize workspace state, use open_workspace(action=\"list\") to inspect candidates, then resume a selected workspaceId or ask the user before close_workspace cleanup.";
         const cardInstruction = config.skillsEnabled
-            ? `Use this workspaceId in all subsequent tool calls for this project. Follow loaded agentsFiles instructions. Read an availableAgentsFiles path before working under it. When a task matches an available skill or capability guide, read its advertised path before proceeding. ${workspaceContextInstruction} ${workspaceManagementInstruction}`
+            ? `Use this workspaceId in all subsequent tool calls for this project. Follow loaded agentsFiles instructions. Read an availableAgentsFiles path before working under it. When a task matches an available skill, load it with read(path=\"skills://<name>\") before proceeding. When a task matches a capability guide, read its advertised path before proceeding. ${workspaceContextInstruction} ${workspaceManagementInstruction}`
             : `Use this workspaceId in all subsequent tool calls for this project. Follow loaded agentsFiles instructions. Read an availableAgentsFiles path before working under it. When a task matches a capability guide, read its advertised path before proceeding. ${workspaceContextInstruction} ${workspaceManagementInstruction}`;
         const instruction = workspaceReused
             ? includeBootstrapContext
@@ -1940,7 +2080,7 @@ export function createMcpServer(config, workspaces, reviewCheckpoints, processSe
             success: true,
             durationMs: Math.round(performance.now() - startedAt),
         });
-        return hooks.decorateResult(workspace.id, attachHookReports({
+        const response = hooks.decorateResult(workspace.id, attachHookReports({
             content: resultContent,
             _meta: {
                 tool: "open_workspace",
@@ -1995,14 +2135,16 @@ export function createMcpServer(config, workspaces, reviewCheckpoints, processSe
                         skills: visibleSkills,
                         agentProviders: visibleAgentProviders,
                         agents: visibleAgents,
-                        skillDiagnostics: workspace.skillDiagnostics,
+                        skillDiagnostics: visibleSkillDiagnostics,
                     }
                     : {}),
                 instruction,
             },
         }, hookReports));
+        rememberWorkspacePanelState(workspace.id, response);
+        return response;
     });
-    registerActivityQueryTools(server, activityQueries);
+    registerActivityQueryTools(server, activityQueries, connectionScopeId, toolWidgetDescriptorMeta(config, "activity")._meta, config.activityPanelExpanded, config.logging, (workspaceId) => workspacePanelStates.get(workspaceId));
     registerAppTool(server, toolNames.capability, {
         title: "Use optional capability",
         description: "Describe or run one optional ForgeRelay capability advertised by open_workspace. Use describe when the capability contract is unfamiliar, then read its advertised guide if needed. Run dispatches only explicitly registered capabilities; it cannot invoke arbitrary shell commands, URLs, or methods.",
@@ -2096,7 +2238,7 @@ export function createMcpServer(config, workspaces, reviewCheckpoints, processSe
             });
         }
         const workspace = workspaces.getWorkspace(workspaceId);
-        return runActivityToolWithHooks(activityLifecycle, hooks, workspace, extra._meta, { workspaceId, name, action, arguments: capabilityArguments, file }, {
+        return runActivityToolWithHooks(activityLifecycle, hooks, workspace, hostScopeIdFor(extra._meta, extra.sessionId), { workspaceId, name, action, arguments: capabilityArguments, file }, {
             signal: extra.signal,
             tool: toolNames.capability,
             invocation: workspaceHookInvocation(workspace),
@@ -2177,7 +2319,7 @@ export function createMcpServer(config, workspaces, reviewCheckpoints, processSe
         annotations: WRITE_TOOL_ANNOTATIONS,
     }, async ({ workspaceId, commitMessage }, extra) => {
         const workspace = workspaces.getWorkspace(workspaceId);
-        return runToolWithHooks(hooks, {
+        const response = await runToolWithHooks(hooks, {
             signal: extra.signal,
             tool: toolNames.closeWorkspace,
             invocation: workspaceHookInvocation(workspace),
@@ -2225,6 +2367,21 @@ export function createMcpServer(config, workspaces, reviewCheckpoints, processSe
                     });
                     return attachHookReports({
                         content: [textBlock(result)],
+                        _meta: {
+                            tool: toolNames.closeWorkspace,
+                            card: {
+                                workspaceId,
+                                mode: "worktree",
+                                sourceRoot: closed.sourceRoot,
+                                branch: closed.branch,
+                                targetBranch: closed.targetBranch,
+                                commitSha: closed.commitSha,
+                                mergedSha: closed.mergedSha,
+                                committed: closed.committed,
+                                cleanupWarning: closed.cleanupWarning,
+                                payload: { content: [textBlock(result)] },
+                            },
+                        },
                         structuredContent: {
                             result,
                             workspaceId,
@@ -2250,10 +2407,20 @@ export function createMcpServer(config, workspaces, reviewCheckpoints, processSe
                 const result = `Closed checkout-backed workspace ${workspaceId}. Physical project files were not removed.`;
                 return {
                     content: [textBlock(result)],
+                    _meta: {
+                        tool: toolNames.closeWorkspace,
+                        card: {
+                            workspaceId,
+                            mode: "checkout",
+                            payload: { content: [textBlock(result)] },
+                        },
+                    },
                     structuredContent: { result, workspaceId, mode: "checkout" },
                 };
             },
         });
+        workspacePanelStates.delete(workspaceId);
+        return response;
     });
     registerAppTool(server, toolNames.read, {
         title: "Read file",
@@ -2266,7 +2433,7 @@ export function createMcpServer(config, workspaces, reviewCheckpoints, processSe
                 .string()
                 .optional()
                 .describe(config.skillsEnabled
-                ? "One file path to read, relative to the workspace root or absolute inside the OS temp directory. May also be an advertised skill or capability-guide path from open_workspace, including a ~/... home-relative path. Use exactly one of path or paths."
+                ? "One file path to read, relative to the workspace root or absolute inside the OS temp directory. Load an available skill with skills://<name>; after loading it, read files in that skill with skills://<name>/<relative-path>. Advertised capability-guide paths from open_workspace are also readable. Use exactly one of path or paths."
                 : "One file path to read, relative to the workspace root or absolute inside the OS temp directory. May also be an advertised capability-guide path from open_workspace. Use exactly one of path or paths."),
             paths: z
                 .array(z.string())
@@ -2312,7 +2479,7 @@ export function createMcpServer(config, workspaces, reviewCheckpoints, processSe
         }
         const workspace = workspaces.getWorkspace(workspaceId);
         let response;
-        await runActivityTool(activityLifecycle, workspace, extra._meta, toolNames.read, { workspaceId, paths, offset, limit }, async (parentContext) => {
+        await runActivityTool(activityLifecycle, workspace, hostScopeIdFor(extra._meta, extra.sessionId), toolNames.read, { workspaceId, paths, offset, limit }, async (parentContext) => {
             const execution = await executeBulkRead({
                 paths: paths,
                 signal: extra.signal,
@@ -2536,7 +2703,7 @@ export function createMcpServer(config, workspaces, reviewCheckpoints, processSe
             annotations: EDIT_TOOL_ANNOTATIONS,
         }, async ({ workspaceId, patch }, extra) => {
             const workspace = workspaces.getWorkspace(workspaceId);
-            return runActivityToolWithHooks(activityLifecycle, hooks, workspace, extra._meta, { workspaceId, patch }, {
+            return runActivityToolWithHooks(activityLifecycle, hooks, workspace, hostScopeIdFor(extra._meta, extra.sessionId), { workspaceId, patch }, {
                 signal: extra.signal,
                 tool: "apply_patch",
                 invocation: workspaceHookInvocation(workspace),
@@ -2785,7 +2952,7 @@ export function createServer(config = loadConfig(), options = {}) {
     const transports = new McpTransportRegistry({
         maxTransports: MAX_MCP_TRANSPORT_SESSIONS,
     });
-    const mcpUrl = new URL("/mcp", config.publicBaseUrl);
+    const mcpUrl = publicEndpointUrl(config.publicBaseUrl, "mcp");
     const resourceServerUrl = resourceUrlFromServerUrl(mcpUrl);
     const oauthProvider = new SingleUserOAuthProvider(config.oauth, mcpUrl, config.stateDir);
     const bearerAuth = requireBearerAuth({
@@ -2800,7 +2967,7 @@ export function createServer(config = loadConfig(), options = {}) {
     const hostTurnStore = new HostTurnStore(config.stateDir);
     const activityQueries = new ActivityQueryService(hostTurnStore, activityAuditStore, bashOutputStore);
     const activityLifecycle = new ActivityLifecycle(activityAuditStore, {
-        turnIdForConversation: (conversationScopeId) => activityQueries.currentTurnId(conversationScopeId),
+        turnIdForConversation: (conversationScopeId, workspaceId) => activityQueries.currentTurnId(conversationScopeId, workspaceId),
     });
     const reviewCheckpoints = createReviewCheckpointManager();
     const processSessions = new ProcessManager({ outputAudit: bashOutputStore });
@@ -2900,10 +3067,9 @@ export function createServer(config = loadConfig(), options = {}) {
         });
         next();
     });
-    app.use(mcpAuthRouter({
+    app.use(createForgeRelayAuthRouter({
         provider: oauthProvider,
         issuerUrl: new URL(config.publicBaseUrl),
-        baseUrl: new URL(config.publicBaseUrl),
         resourceServerUrl,
         scopesSupported: config.oauth.scopes,
         resourceName: "ForgeRelay",