@akira-tl/forgerelay 1.1.0 → 1.1.2

package/dist/runtime/config/external-mcp-auth-store.js

@@ -0,0 +1,225 @@
+import { createHash, randomBytes, randomUUID } from "node:crypto";
+import { existsSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync, } from "node:fs";
+import { join, resolve } from "node:path";
+import { withFileLock } from "../state/lock/file-lock.js";
+import { forgerelayConfigDir } from "./user-config.js";
+const AUTH_FILE_VERSION = 1;
+const AUTH_FILE_NAME = "mcp-auth.json";
+export class ExternalMcpCredentialStore {
+    configDir;
+    filePath;
+    constructor(options = {}) {
+        this.configDir = resolve(options.configDir ?? forgerelayConfigDir(options.env));
+        this.filePath = join(this.configDir, AUTH_FILE_NAME);
+    }
+    read(identity) {
+        const record = this.readFile().credentials[credentialKey(identity)];
+        if (!record || !sameIdentity(record.identity, identity))
+            return undefined;
+        return cloneRecord(record);
+    }
+    inspect() {
+        const exists = existsSync(this.filePath);
+        const file = this.readFile();
+        return { exists, credentialCount: Object.keys(file.credentials).length };
+    }
+    async replace(identity, serverUrl, record) {
+        let written;
+        await this.updateFile((file) => {
+            written = {
+                ...cloneRecord(record),
+                identity: normalizeIdentity(identity),
+                serverUrl,
+                revision: randomUUID(),
+                updatedAt: new Date().toISOString(),
+            };
+            file.credentials[credentialKey(identity)] = written;
+        });
+        return cloneRecord(written);
+    }
+    async update(identity, serverUrl, update) {
+        let written;
+        await this.updateFile((file) => {
+            const key = credentialKey(identity);
+            const existing = file.credentials[key];
+            const current = existing && sameIdentity(existing.identity, identity) ? cloneRecord(existing) : undefined;
+            const next = update(current);
+            if (!next) {
+                delete file.credentials[key];
+                written = undefined;
+                return;
+            }
+            written = {
+                ...cloneRecord(next),
+                identity: normalizeIdentity(identity),
+                serverUrl,
+                revision: randomUUID(),
+                updatedAt: new Date().toISOString(),
+            };
+            file.credentials[key] = written;
+        });
+        return written ? cloneRecord(written) : undefined;
+    }
+    async remove(identity) {
+        let removed = false;
+        await this.updateFile((file) => {
+            const key = credentialKey(identity);
+            const existing = file.credentials[key];
+            if (!existing || !sameIdentity(existing.identity, identity))
+                return;
+            delete file.credentials[key];
+            removed = true;
+        });
+        return removed;
+    }
+    withIdentityLock(identity, operation) {
+        mkdirSync(this.configDir, { recursive: true });
+        return withFileLock(join(this.configDir, `.mcp-auth-${credentialKeyHash(identity)}.lock`), operation, {
+            timeoutMs: 15_000,
+            staleMs: 60_000,
+            mode: 0o600,
+        });
+    }
+    readFile() {
+        if (!existsSync(this.filePath))
+            return emptyAuthFile();
+        let raw;
+        try {
+            raw = JSON.parse(readFileSync(this.filePath, "utf8"));
+        }
+        catch {
+            throw new Error(`Unable to read External MCP credential store ${this.filePath}: invalid JSON.`);
+        }
+        return parseAuthFile(raw, this.filePath);
+    }
+    async updateFile(update) {
+        mkdirSync(this.configDir, { recursive: true });
+        await withFileLock(`${this.filePath}.lock`, () => {
+            const file = this.readFile();
+            update(file);
+            writePrivateJsonFile(this.filePath, file);
+        }, { mode: 0o600 });
+    }
+}
+export function externalMcpCredentialIdentity(source, server, projectRoot) {
+    return source === "project"
+        ? { kind: "project", server, projectRoot: resolve(projectRoot) }
+        : { kind: "global", server };
+}
+export function credentialKey(identity) {
+    const normalized = normalizeIdentity(identity);
+    return normalized.kind === "global"
+        ? `global:${normalized.server}`
+        : `project:${credentialKeyHash(normalized)}:${normalized.server}`;
+}
+function credentialKeyHash(identity) {
+    const normalized = normalizeIdentity(identity);
+    const material = normalized.kind === "global"
+        ? `global\0${normalized.server}`
+        : `project\0${normalized.projectRoot}\0${normalized.server}`;
+    return createHash("sha256").update(material).digest("hex");
+}
+function normalizeIdentity(identity) {
+    return identity.kind === "project"
+        ? { kind: "project", server: identity.server, projectRoot: resolve(identity.projectRoot) }
+        : { kind: "global", server: identity.server };
+}
+function sameIdentity(left, right) {
+    const a = normalizeIdentity(left);
+    const b = normalizeIdentity(right);
+    return a.kind === b.kind
+        && a.server === b.server
+        && (a.kind === "global" || (b.kind === "project" && a.projectRoot === b.projectRoot));
+}
+function emptyAuthFile() {
+    return { version: AUTH_FILE_VERSION, credentials: {} };
+}
+function parseAuthFile(value, filePath) {
+    if (!isRecord(value) || value.version !== AUTH_FILE_VERSION || !isRecord(value.credentials)) {
+        throw new Error(`Unable to read External MCP credential store ${filePath}: unsupported format.`);
+    }
+    const credentials = {};
+    for (const [key, raw] of Object.entries(value.credentials)) {
+        credentials[key] = parseCredentialRecord(raw, filePath);
+    }
+    return { version: AUTH_FILE_VERSION, credentials };
+}
+function parseCredentialRecord(value, filePath) {
+    if (!isRecord(value) || !isCredentialIdentity(value.identity)) {
+        throw new Error(`Unable to read External MCP credential store ${filePath}: invalid credential identity.`);
+    }
+    if (typeof value.serverUrl !== "string"
+        || typeof value.revision !== "string"
+        || typeof value.updatedAt !== "string") {
+        throw new Error(`Unable to read External MCP credential store ${filePath}: invalid credential metadata.`);
+    }
+    if (value.tokens !== undefined
+        && (!isRecord(value.tokens) || typeof value.tokens.access_token !== "string")) {
+        throw new Error(`Unable to read External MCP credential store ${filePath}: invalid token record.`);
+    }
+    if (value.clientInformation !== undefined
+        && (!isRecord(value.clientInformation) || typeof value.clientInformation.client_id !== "string")) {
+        throw new Error(`Unable to read External MCP credential store ${filePath}: invalid client record.`);
+    }
+    if (value.discoveryState !== undefined
+        && (!isRecord(value.discoveryState) || typeof value.discoveryState.authorizationServerUrl !== "string")) {
+        throw new Error(`Unable to read External MCP credential store ${filePath}: invalid discovery record.`);
+    }
+    const reauthorization = parseReauthorization(value.reauthorization, filePath);
+    return {
+        identity: normalizeIdentity(value.identity),
+        serverUrl: value.serverUrl,
+        revision: value.revision,
+        updatedAt: value.updatedAt,
+        ...(value.tokens ? { tokens: structuredClone(value.tokens) } : {}),
+        ...(value.clientInformation
+            ? { clientInformation: structuredClone(value.clientInformation) }
+            : {}),
+        ...(value.discoveryState
+            ? { discoveryState: structuredClone(value.discoveryState) }
+            : {}),
+        ...(typeof value.authorizationServerUrl === "string"
+            ? { authorizationServerUrl: value.authorizationServerUrl }
+            : {}),
+        ...(typeof value.resourceUrl === "string" ? { resourceUrl: value.resourceUrl } : {}),
+        ...(reauthorization ? { reauthorization } : {}),
+    };
+}
+function parseReauthorization(value, filePath) {
+    if (value === undefined)
+        return undefined;
+    if (!isRecord(value)
+        || !["authorization_required", "invalid_grant", "insufficient_scope", "binding_changed"].includes(String(value.reason))
+        || typeof value.observedAt !== "string"
+        || (value.scope !== undefined && typeof value.scope !== "string")) {
+        throw new Error(`Unable to read External MCP credential store ${filePath}: invalid reauthorization state.`);
+    }
+    return {
+        reason: value.reason,
+        observedAt: value.observedAt,
+        ...(typeof value.scope === "string" && value.scope.trim() ? { scope: value.scope.trim() } : {}),
+    };
+}
+function isCredentialIdentity(value) {
+    if (!isRecord(value) || typeof value.server !== "string" || !value.server)
+        return false;
+    if (value.kind === "global")
+        return true;
+    return value.kind === "project" && typeof value.projectRoot === "string" && Boolean(value.projectRoot);
+}
+function cloneRecord(value) {
+    return structuredClone(value);
+}
+function writePrivateJsonFile(filePath, value) {
+    const temporary = `${filePath}.${process.pid}.${randomBytes(6).toString("hex")}.tmp`;
+    try {
+        writeFileSync(temporary, `${JSON.stringify(value, null, 2)}\n`, { mode: 0o600 });
+        renameSync(temporary, filePath);
+    }
+    finally {
+        rmSync(temporary, { force: true });
+    }
+}
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}

package/dist/runtime/config/external-mcp-config.js

@@ -1,33 +1,54 @@
 const MCP_SERVER_NAME_PATTERN = /^[a-z][a-z0-9._-]{0,63}$/;
 const MAX_MCP_SERVERS = 32;
 export function parseExternalMcpServers(value) {
-    if (value === undefined)
+    return parseServerRegistry(value, "mcpServers", false);
+}
+export function parseExternalMcpStandaloneConfig(value) {
+    if (!isRecord(value))
+        throw new Error("External MCP configuration must be a JSON object.");
+    rejectUnknownKeys(value, new Set(["servers"]), "External MCP configuration");
+    if (!("servers" in value))
+        throw new Error("External MCP configuration must contain a servers object.");
+    return parseServerRegistry(value.servers, "servers", true);
+}
+function parseServerRegistry(value, label, allowDisabled) {
+    if (value === undefined && !allowDisabled)
         return {};
     if (!isRecord(value))
-        throw new Error("mcpServers must be an object keyed by server name.");
+        throw new Error(`${label} must be an object keyed by server name.`);
     const entries = Object.entries(value);
     if (entries.length > MAX_MCP_SERVERS) {
-        throw new Error(`mcpServers may contain at most ${MAX_MCP_SERVERS} configured servers.`);
+        throw new Error(`${label} may contain at most ${MAX_MCP_SERVERS} configured servers.`);
     }
     return Object.fromEntries(entries.map(([name, raw]) => {
         if (!MCP_SERVER_NAME_PATTERN.test(name)) {
-            throw new Error(`Invalid mcpServers name '${name}'. Use a lowercase stable name.`);
+            throw new Error(`Invalid ${label} name '${name}'. Use a lowercase stable name.`);
         }
         if (!isRecord(raw))
-            throw new Error(`mcpServers.${name} must be an object.`);
-        if (raw.transport === "stdio")
-            return [name, parseStdio(name, raw)];
-        if (raw.transport === "streamable-http")
-            return [name, parseHttp(name, raw)];
-        throw new Error(`mcpServers.${name}.transport must be 'stdio' or 'streamable-http'.`);
+            throw new Error(`${label}.${name} must be an object.`);
+        const disabled = allowDisabled && "disabled" in raw ? parseDisabled(raw.disabled, `${label}.${name}.disabled`) : false;
+        const serverValue = allowDisabled && "disabled" in raw
+            ? Object.fromEntries(Object.entries(raw).filter(([key]) => key !== "disabled"))
+            : raw;
+        if (disabled && Object.keys(serverValue).length === 0) {
+            return [name, { disabled: true }];
+        }
+        const server = serverValue.transport === "stdio"
+            ? parseStdio(name, serverValue, label)
+            : serverValue.transport === "streamable-http"
+                ? parseHttp(name, serverValue, label)
+                : undefined;
+        if (!server)
+            throw new Error(`${label}.${name}.transport must be 'stdio' or 'streamable-http'.`);
+        return [name, disabled ? { disabled: true } : server];
     }));
 }
-function parseStdio(name, value) {
-    const command = requiredString(value.command, `mcpServers.${name}.command`);
-    const args = optionalStringArray(value.args, `mcpServers.${name}.args`);
-    const env = optionalStringRecord(value.env, `mcpServers.${name}.env`);
-    const cwd = optionalString(value.cwd, `mcpServers.${name}.cwd`);
-    rejectUnknownKeys(value, new Set(["transport", "command", "args", "env", "cwd"]), `mcpServers.${name}`);
+function parseStdio(name, value, label) {
+    const command = requiredString(value.command, `${label}.${name}.command`);
+    const args = optionalStringArray(value.args, `${label}.${name}.args`);
+    const env = optionalStringRecord(value.env, `${label}.${name}.env`);
+    const cwd = optionalString(value.cwd, `${label}.${name}.cwd`);
+    rejectUnknownKeys(value, new Set(["transport", "command", "args", "env", "cwd"]), `${label}.${name}`);
     return {
         transport: "stdio",
         command,
@@ -36,26 +57,59 @@ function parseStdio(name, value) {
         ...(cwd ? { cwd } : {}),
     };
 }
-function parseHttp(name, value) {
-    const url = requiredString(value.url, `mcpServers.${name}.url`);
+function parseHttp(name, value, label) {
+    const url = requiredString(value.url, `${label}.${name}.url`);
     let parsed;
     try {
         parsed = new URL(url);
     }
     catch {
-        throw new Error(`mcpServers.${name}.url must be a valid HTTP(S) URL.`);
+        throw new Error(`${label}.${name}.url must be a valid HTTP(S) URL.`);
     }
     if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
-        throw new Error(`mcpServers.${name}.url must use http or https.`);
+        throw new Error(`${label}.${name}.url must use http or https.`);
     }
-    const headers = optionalStringRecord(value.headers, `mcpServers.${name}.headers`);
-    rejectUnknownKeys(value, new Set(["transport", "url", "headers"]), `mcpServers.${name}`);
+    const headers = optionalStringRecord(value.headers, `${label}.${name}.headers`);
+    const oauth = parseOAuthClientConfig(value.oauth, `${label}.${name}.oauth`);
+    rejectUnknownKeys(value, new Set(["transport", "url", "headers", "oauth"]), `${label}.${name}`);
     return {
         transport: "streamable-http",
         url: parsed.toString(),
         ...(headers ? { headers } : {}),
+        ...(oauth ? { oauth } : {}),
     };
 }
+function parseOAuthClientConfig(value, label) {
+    if (value === undefined)
+        return undefined;
+    if (!isRecord(value))
+        throw new Error(`${label} must be an object.`);
+    rejectUnknownKeys(value, new Set(["clientMetadataUrl", "callbackPort"]), label);
+    const clientMetadataUrl = requiredString(value.clientMetadataUrl, `${label}.clientMetadataUrl`);
+    let parsed;
+    try {
+        parsed = new URL(clientMetadataUrl);
+    }
+    catch {
+        throw new Error(`${label}.clientMetadataUrl must be a valid HTTPS URL.`);
+    }
+    if (parsed.protocol !== "https:" || parsed.pathname === "/") {
+        throw new Error(`${label}.clientMetadataUrl must use https and contain a non-root path.`);
+    }
+    const callbackPort = value.callbackPort;
+    if (!Number.isInteger(callbackPort) || Number(callbackPort) < 1024 || Number(callbackPort) > 65535) {
+        throw new Error(`${label}.callbackPort must be an integer from 1024 to 65535.`);
+    }
+    return {
+        clientMetadataUrl: parsed.toString(),
+        callbackPort: Number(callbackPort),
+    };
+}
+function parseDisabled(value, label) {
+    if (typeof value !== "boolean")
+        throw new Error(`${label} must be a boolean.`);
+    return value;
+}
 function requiredString(value, label) {
     if (typeof value !== "string" || !value.trim())
         throw new Error(`${label} must be a non-empty string.`);

package/dist/runtime/config/external-mcp-registry.js

@@ -0,0 +1,165 @@
+import { createHash } from "node:crypto";
+import { readFileSync } from "node:fs";
+import { join, resolve } from "node:path";
+import { parseExternalMcpStandaloneConfig, } from "./external-mcp-config.js";
+const MISSING_FINGERPRINT = "missing";
+const MAX_DIAGNOSTIC_LENGTH = 320;
+export class ExternalMcpConfigRegistry {
+    configDir;
+    legacyServers;
+    onDiagnostic;
+    global;
+    projects = new Map();
+    constructor(options) {
+        this.configDir = resolve(options.configDir);
+        this.legacyServers = { ...(options.legacyServers ?? {}) };
+        this.onDiagnostic = options.onDiagnostic;
+    }
+    resolve(workspaceRoot) {
+        const projectRoot = resolve(workspaceRoot);
+        const global = this.loadGlobalSource();
+        const projectPath = join(projectRoot, ".forgerelay", "mcp.json");
+        const project = this.loadDynamicSource("project", projectPath, this.projects.get(projectRoot));
+        this.projects.set(projectRoot, project);
+        return this.composeSnapshot(global, project);
+    }
+    resolveGlobal() {
+        return this.composeSnapshot(this.loadGlobalSource());
+    }
+    loadGlobalSource() {
+        const globalPath = join(this.configDir, "mcp.json");
+        this.global = this.loadDynamicSource("global", globalPath, this.global);
+        return this.global;
+    }
+    composeSnapshot(global, project) {
+        const servers = { ...this.legacyServers };
+        const origins = Object.fromEntries(Object.keys(this.legacyServers).map((name) => [name, "legacy"]));
+        const masked = {};
+        applySource(servers, origins, masked, global.entries, "global");
+        if (project)
+            applySource(servers, origins, masked, project.entries, "project");
+        const diagnostics = [global.diagnostic, project?.diagnostic]
+            .filter((entry) => entry !== undefined);
+        return {
+            servers,
+            origins,
+            masked,
+            sources: [
+                {
+                    source: "legacy",
+                    path: join(this.configDir, "config.json"),
+                    state: "valid",
+                    usingLastKnownGood: false,
+                },
+                global.status,
+                ...(project ? [project.status] : []),
+            ],
+            diagnostics,
+        };
+    }
+    loadDynamicSource(source, path, previous) {
+        let content;
+        try {
+            content = readFileSync(path, "utf8");
+        }
+        catch (error) {
+            if (isMissingFileError(error)) {
+                if (previous?.observedFingerprint === MISSING_FINGERPRINT)
+                    return previous;
+                return {
+                    observedFingerprint: MISSING_FINGERPRINT,
+                    entries: {},
+                    hasLastKnownGood: true,
+                    status: {
+                        source,
+                        path,
+                        state: "missing",
+                        usingLastKnownGood: false,
+                    },
+                };
+            }
+            const fingerprint = `read-error:${errorCode(error)}`;
+            if (previous?.observedFingerprint === fingerprint)
+                return previous;
+            return this.invalidSource(source, path, fingerprint, previous, error);
+        }
+        const fingerprint = createHash("sha256").update(content).digest("base64url");
+        if (previous?.observedFingerprint === fingerprint)
+            return previous;
+        let parsed;
+        try {
+            parsed = JSON.parse(content);
+        }
+        catch {
+            return this.invalidSource(source, path, fingerprint, previous, new Error("Invalid JSON syntax."));
+        }
+        try {
+            const entries = parseExternalMcpStandaloneConfig(parsed);
+            return {
+                observedFingerprint: fingerprint,
+                entries,
+                hasLastKnownGood: true,
+                status: {
+                    source,
+                    path,
+                    state: "valid",
+                    usingLastKnownGood: false,
+                },
+            };
+        }
+        catch (error) {
+            return this.invalidSource(source, path, fingerprint, previous, error);
+        }
+    }
+    invalidSource(source, path, observedFingerprint, previous, error) {
+        const diagnostic = {
+            source,
+            path,
+            message: boundedDiagnosticMessage(error),
+        };
+        this.onDiagnostic?.(diagnostic);
+        return {
+            observedFingerprint,
+            entries: previous?.entries ?? {},
+            hasLastKnownGood: previous?.hasLastKnownGood ?? false,
+            status: {
+                source,
+                path,
+                state: "invalid",
+                usingLastKnownGood: previous?.hasLastKnownGood === true,
+            },
+            diagnostic,
+        };
+    }
+}
+function applySource(servers, origins, masked, entries, source) {
+    for (const [name, entry] of Object.entries(entries)) {
+        if ("disabled" in entry && entry.disabled === true) {
+            delete servers[name];
+            delete origins[name];
+            masked[name] = source;
+            continue;
+        }
+        servers[name] = entry;
+        origins[name] = source;
+        delete masked[name];
+    }
+}
+function boundedDiagnosticMessage(error) {
+    const raw = error instanceof Error ? error.message : String(error);
+    const normalized = raw.replace(/\s+/g, " ").trim() || "Invalid External MCP configuration.";
+    return normalized.length <= MAX_DIAGNOSTIC_LENGTH
+        ? normalized
+        : `${normalized.slice(0, MAX_DIAGNOSTIC_LENGTH - 3)}...`;
+}
+function isMissingFileError(error) {
+    return errorCode(error) === "ENOENT";
+}
+function errorCode(error) {
+    if (typeof error === "object" && error !== null && "code" in error) {
+        const code = error.code;
+        if (typeof code === "string" && code)
+            return code;
+    }
+    return "UNKNOWN";
+}

package/dist/runtime/testing/server-fixture.js

@@ -4,8 +4,7 @@ import { mkdir, mkdtemp, rm, writeFile } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { promisify } from "node:util";
-import { Client } from "@modelcontextprotocol/sdk/client/index.js";
-import { InMemoryTransport } from "@modelcontextprotocol/sdk/inMemory.js";
+import { Client, InMemoryTransport } from "@modelcontextprotocol/client";
 import { ActivityAuditStore } from "../../activity/history/audit-store.js";
 import { BashOutputStore } from "../../activity/history/bash-output-store.js";
 import { HostTurnStore } from "../../activity/history/host-turn-store.js";
@@ -148,8 +147,9 @@ export async function callOpen(client, path, conversationScopeId, mode, newWorkt
     return client.callTool(params);
 }
 export function structuredContent(result) {
-    assert.ok(result.structuredContent);
-    return result.structuredContent;
+    const structured = result.structuredContent;
+    assert.ok(structured);
+    return structured;
 }
 export function responseText(result) {
     const content = result.content;

package/dist/server.js

@@ -1,7 +1,7 @@
 import { randomUUID } from "node:crypto";
 import { realpath } from "node:fs/promises";
 import { fileURLToPath } from "node:url";
-import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { McpServer } from "@modelcontextprotocol/server";
 import { registerAppResource } from "@modelcontextprotocol/ext-apps/server";
 import { registerActivityQueryTools } from "./activity/runtime/mcp-query-tools.js";
 import { buildCapabilityFingerprint, loadCapabilityGuides } from "./mcp/server/core/capabilities.js";
@@ -21,7 +21,8 @@ import { attachCompletedProcessNotices, recordBashCompletion } from "./mcp/proce
 import { CompositeActivityCoordinator } from "./workspaces/composite/composite-activity.js";
 import { CompositeWorkspaceRegistry } from "./workspaces/composite/composite-workspaces.js";
 import { RemoteWorkspaceRelay } from "./workspaces/relay/workspace-relay.js";
-import { hostConversationScopeId } from "./mcp/request-meta.js";
+import { hostContextDeliveryScopeId, hostConversationScopeId } from "./mcp/request-meta.js";
+import { mcpHandlerRequestContext } from "./mcp/request-context.js";
 import { createActivityPanelApp } from "./mcp/panel/app.js";
 import { shutdownHttpServer } from "./mcp/server/transport/server-shutdown.js";
 import { formatPathForPrompt } from "./workspaces/resources/skills.js";
@@ -110,16 +111,20 @@ export function createMcpServer(config, workspaces, reviewCheckpoints, processSe
         const reminderWorkspaceId = taskReminderWorkspaceIdFor(target);
         return attachWorkspaceTaskReminder(presented, reminderWorkspaceId ? taskReminders.recordWork(reminderWorkspaceId) : undefined);
     };
-    const hostScopeIdFor = (requestMeta, transportSessionId) => hostConversationScopeId(requestMeta, transportSessionId, connectionScopeId);
-    const prepareExecutionContext = async (target, requestMeta, signal, sessionId) => {
-        const conversationScopeId = hostScopeIdFor(requestMeta, sessionId);
+    const hostScopeIdFor = (requestContext) => hostConversationScopeId(requestContext, connectionScopeId);
+    const contextDeliveryScopeIdFor = (requestContext) => hostContextDeliveryScopeId(requestContext, connectionScopeId);
+    const prepareExecutionContext = async (target, requestContext) => {
+        const conversationScopeId = hostScopeIdFor(requestContext);
         const turnId = target.compositeWorkspaceId && target.memberName
             ? await compositeActivity.prepareMember(target.compositeWorkspaceId, target.memberName, target.executionWorkspaceId, conversationScopeId)
             : undefined;
         return {
-            requestMeta,
-            signal,
-            sessionId,
+            requestMeta: requestContext.requestMeta,
+            signal: requestContext.signal,
+            sessionId: requestContext.transportSessionId,
+            requestId: requestContext.requestId,
+            protocolEra: requestContext.protocolEra,
+            conversationScopeId,
             ...(turnId ? { turnId } : {}),
             ...(target.memberName ? { activityMember: target.memberName } : {}),
         };
@@ -460,10 +465,11 @@ export function createMcpServer(config, workspaces, reviewCheckpoints, processSe
             ...compact,
         });
     };
-    registerAppResource(server, "ForgeRelay Activity Panel", activityPanelApp.uri, activityPanelApp.resourceMetadata, async (uri, extra) => activityPanelApp.readResource(uri.toString(), extra.sessionId));
+    registerAppResource(server, "ForgeRelay Activity Panel", activityPanelApp.uri, activityPanelApp.resourceMetadata, async (uri, extra) => activityPanelApp.readResource(uri.toString(), mcpHandlerRequestContext(extra).transportSessionId));
     registerOpenWorkspaceTool({
         server, config, workspaces, remoteWorkspaces, compositeWorkspaces, workspaceTasks, processSessions,
         capabilityRegistry, compositeTaskGuides, loadCompositeMemberContext, rememberWorkspacePanelState, hostScopeIdFor,
+        contextDeliveryScopeIdFor,
         presentation: {
             config, forgerelayVersion: FORGERELAY_VERSION, workspaces, workspaceTasks, reviewCheckpoints,
             capabilityRegistry, subagentProviders, hooks, rememberWorkspacePanelState,