@akira-tl/forgerelay 1.2.0 → 1.2.2

package/CHANGELOG.md

@@ -4,6 +4,25 @@ All notable ForgeRelay changes are documented here.
 
 ## [Unreleased]
 
+## [1.2.2] - 2026-09-13
+
+### Fixed
+
+- 修复带路径前缀的 `publicBaseUrl` 在 MCP SDK v2 下被 Origin 校验错误拒绝的问题；ForgeRelay 现在只从 canonical public URL 派生允许的 Origin hostname，同时继续拒绝 foreign / malformed Origin。
+- OAuth authorization callback 现在带回 metadata 中公布的 `iss`，使 routed public URL 的现代 OAuth 流程保持 issuer 一致。
+- MCP App 的 CSP `resourceDomains` / `connectDomains` 现在使用 URL Origin，而不是包含部署路径的完整 `publicBaseUrl`，避免 path-prefix 部署下 Activity Panel 只停留在 `Waiting for Activity Panel state.`。
+- Skill 默认发现范围收敛为 Project `.agents/skills`、Project `.forgerelay/skills` 与 active ForgeRelay config `skills`；不再自动扫描全局 `~/.agents/skills` 或 `FORGERELAY_AGENT_DIR/skills`，显式 `FORGERELAY_SKILL_PATHS` 仍作为用户附加来源。
+
+## [1.2.1] - 2026-09-13
+
+### Fixed
+
+- Reconstruct relayed and Composite Workspace Panel presentation from durable Workspace state across modern/stateless MCP requests, preventing the ChatGPT Activity Panel from remaining on `Waiting...` after a relayed `open_workspace`; closed Workspaces remain non-renderable.
+
+### Changed
+
+- Added Composite + Relay execution-context coverage to the authoritative `workspace-mcp` test shard, with Shell Instructions enabled explicitly where that opt-in behavior is under test.
+
 ## [1.2.0] - 2026-09-13
 
 ### Changed

package/dist/mcp/oauth/router.js

@@ -56,7 +56,7 @@ export function createForgeRelayAuthRouter(options) {
             res.status(200).json({ ...tokens, ...(instanceId ? { instance_id: instanceId } : {}) });
         });
     }
-    router.use(authorizationPaths, authorizationHandler({ provider }));
+    router.use(authorizationPaths, authorizationHandler({ provider, issuerUrl }));
     router.use(tokenPaths, tokenHandler({ provider }));
     if (provider.clientsStore.registerClient && registrationEndpoint) {
         router.use(registrationPaths, clientRegistrationHandler({ clientsStore: provider.clientsStore }));

package/dist/mcp/panel/app.js

@@ -64,9 +64,10 @@ function currentIdentity(config, fallbackRevision) {
     return identity;
 }
 function activityPanelCsp(config) {
+    const publicOrigins = Array.from(new Set(config.publicBaseUrls.map((baseUrl) => new URL(baseUrl).origin)));
     return {
-        resourceDomains: [...config.publicBaseUrls],
-        connectDomains: [...config.publicBaseUrls],
+        resourceDomains: publicOrigins,
+        connectDomains: publicOrigins,
     };
 }
 async function readActivityPanelAppResource(config, fallbackRevision, requestedUri, transportSessionId) {

package/dist/mcp/server/transport/http-server.js

@@ -1,5 +1,5 @@
 import { randomUUID } from "node:crypto";
-import { checkResourceAllowed, createMcpHandler, isInitializeRequest, isLegacyRequest, resourceUrlFromServerUrl, } from "@modelcontextprotocol/server";
+import { checkResourceAllowed, createMcpHandler, isInitializeRequest, isLegacyRequest, localhostAllowedOrigins, resourceUrlFromServerUrl, } from "@modelcontextprotocol/server";
 import { createMcpExpressApp, getOAuthProtectedResourceMetadataUrl, requireBearerAuth, } from "@modelcontextprotocol/express";
 import { NodeStreamableHTTPServerTransport, toNodeHandler, toWebRequest, } from "@modelcontextprotocol/node";
 import express from "express";
@@ -32,17 +32,22 @@ const MCP_TRANSPORT_CLEANUP_INTERVAL_MS = 5 * 60 * 1_000;
 export function createHttpServer(config, options, createMcpServer) {
     const incomingArtifactAdapters = options.incomingArtifactAdapters
         ?? [createOpenAIIncomingArtifactAdapter()];
+    const routeBaseUrls = config.publicBaseUrls.map((baseUrl) => new URL(baseUrl));
     const allowedHosts = config.allowedHosts.includes("*")
         ? undefined
         : Array.from(new Set([config.host, ...config.allowedHosts]));
+    const allowedOrigins = Array.from(new Set([
+        ...localhostAllowedOrigins(),
+        ...routeBaseUrls.map((baseUrl) => baseUrl.hostname),
+    ]));
     const app = createMcpExpressApp({
         host: config.host,
         ...(allowedHosts ? { allowedHosts } : {}),
+        allowedOrigins,
     });
     const transports = new McpTransportRegistry({
         maxTransports: MAX_MCP_TRANSPORT_SESSIONS,
     });
-    const routeBaseUrls = config.publicBaseUrls.map((baseUrl) => new URL(baseUrl));
     const mcpUrl = publicEndpointUrl(config.publicBaseUrl, "mcp");
     const mcpPaths = publicEndpointPaths(routeBaseUrls, "mcp");
     const activityPanelAssetsPaths = publicEndpointPaths(routeBaseUrls, "mcp-app-assets");

package/dist/server.js

@@ -30,7 +30,7 @@ import { formatPathForPrompt } from "./workspaces/resources/skills.js";
 import { WorkspaceTaskReminderTracker } from "./workspaces/tasks/workspace-task-reminders.js";
 import { WorkspaceTaskStore } from "./workspaces/tasks/workspace-tasks.js";
 import { WorkspaceCheckpointStore } from "./workspaces/state/workspace-checkpoints.js";
-import { compactWorkspacePresentation } from "./workspaces/presentation/workspace-presentation.js";
+import { compactCompositeWorkspacePresentation, compactRelayedWorkspacePresentation, compactWorkspacePresentation, } from "./workspaces/presentation/workspace-presentation.js";
 import { formatAgentsPath } from "./workspaces.js";
 import { summarizeSubagentProfile } from "./subagents/profiles.js";
 import { formatSubagentProviderAvailabilitySummary } from "./subagents/providers/availability.js";
@@ -442,8 +442,26 @@ export function createMcpServer(config, workspaces, reviewCheckpoints, processSe
     };
     const workspacePanelState = async (workspaceId) => {
         const remembered = workspacePanelStates.get(workspaceId);
-        if (remoteWorkspaces.has(workspaceId) || compositeWorkspaces.has(workspaceId)) {
-            return remembered;
+        if (compositeWorkspaces.has(workspaceId)) {
+            if (remembered)
+                return remembered;
+            const composite = compositeWorkspaces.get(workspaceId);
+            return composite.status === "active"
+                ? compactCompositeWorkspacePresentation(composite)
+                : undefined;
+        }
+        if (remoteWorkspaces.has(workspaceId)) {
+            if (remembered)
+                return remembered;
+            try {
+                const inspected = await remoteWorkspaces.inspectWorkspace(workspaceId);
+                return inspected.status === "closed" || inspected.state === "closed"
+                    ? undefined
+                    : compactRelayedWorkspacePresentation(inspected);
+            }
+            catch {
+                return undefined;
+            }
         }
         try {
             const workspace = workspaces.getWorkspace(workspaceId);

package/dist/workspaces/presentation/workspace-presentation.js

@@ -37,6 +37,27 @@ export function compactWorkspacePresentation(card) {
     presentation.presentationRevision = presentationRevision(card, presentation);
     return presentation;
 }
+export function compactCompositeWorkspacePresentation(composite) {
+    return compactWorkspacePresentation({
+        workspaceId: composite.id,
+        kind: "composite",
+        name: composite.name,
+        path: composite.name,
+        members: composite.members,
+        summary: { members: composite.members.length, status: composite.status },
+    });
+}
+export function compactRelayedWorkspacePresentation(inspected) {
+    return compactWorkspacePresentation({
+        workspaceId: inspected.workspaceId,
+        kind: inspected.kind,
+        root: inspected.root,
+        path: inspected.root,
+        mode: inspected.mode,
+        sourceRoot: inspected.sourceRoot,
+        summary: { mode: inspected.mode, relay: inspected.relay },
+    });
+}
 function projectExecutionContext(value) {
     if (!value || typeof value !== "object" || Array.isArray(value))
         return undefined;

package/dist/workspaces/relay/tests/test-support.js

@@ -68,6 +68,7 @@ export async function startForge(t, options) {
         ...(options.taskReminderInterval !== undefined ? { taskReminderInterval: options.taskReminderInterval } : {}),
         ...(options.mediaMaxBytes !== undefined ? { mediaMaxBytes: options.mediaMaxBytes } : {}),
         ...(options.mcpServers ? { mcpServers: options.mcpServers } : {}),
+        ...(options.shellInstructions !== undefined ? { shellInstructions: options.shellInstructions } : {}),
         ...(options.hooks ? { hooks: options.hooks } : {}),
     }, null, 2));
     const env = {

package/dist/workspaces/resources/skills.js

@@ -8,9 +8,8 @@ const FRONTMATTER_DELIMITER = "---";
 export function effectiveSkillPaths(config, cwd) {
     const defaultPathCandidates = [
         resolve(cwd, ".agents", "skills"),
-        join(homedir(), ".agents", "skills"),
+        resolve(cwd, ".forgerelay", "skills"),
         config.configSkillsDir,
-        join(config.agentDir, "skills"),
     ];
     const defaultPaths = defaultPathCandidates.filter((path) => path !== undefined && existsSync(path));
     const seen = new Set();

package/docs/chatgpt-coding-workflow.md

@@ -189,7 +189,8 @@ instructions before the requested file content. Side-effecting file tools and sh
 commands discover instructions before execution; if new local instructions are
 found, ForgeRelay returns them and requires the Agent to retry, so the side effect
 does not occur before the relevant instructions are known. `FORGERELAY_AGENT_DIR`
-is not an instruction source; it remains only a compatibility skill-discovery path.
+is neither an instruction source nor an automatic Skill-discovery source; it remains
+an integration runtime directory for supported Agent tooling.
 
 ## MCP capability loading
 
@@ -232,17 +233,16 @@ force the Host to discard a cached tool schema.
 
 ## Agent Skills
 
-ForgeRelay discovers standard Agent Skills in precedence order from:
+ForgeRelay discovers Skills in precedence order from:
 
 - project `.agents/skills`
-- `~/.agents/skills`
-- the active ForgeRelay config directory's `skills` folder
-- `FORGERELAY_AGENT_DIR/skills` (defaults to `~/.codex/skills`)
-- paths from `FORGERELAY_SKILL_PATHS`
+- project `.forgerelay/skills`
+- the active ForgeRelay config directory's `skills` folder (`~/.forgerelay/skills` by default)
+- paths explicitly added through `FORGERELAY_SKILL_PATHS`
 
-These paths are discovery sources, not one shared ownership domain. `.agents/skills` is the open Agent Skills ecosystem and may contain files or symlinks managed by other Agent tooling. ForgeRelay-owned Skills remain private to the active ForgeRelay config directory (`~/.forgerelay/skills` by default) and are never migrated into `~/.agents/skills`.
+These paths are discovery sources, not one shared ownership domain. Project `.agents/skills` is the open Agent Skills ecosystem and may contain files or symlinks managed by other Agent tooling. ForgeRelay-owned project/system Skills stay under `.forgerelay/skills` and the active ForgeRelay config directory. ForgeRelay does not automatically scan global Agent runtime Skill directories such as `~/.agents/skills` or `FORGERELAY_AGENT_DIR/skills`.
 
-Same-named collisions use the first source, so project Skills override global Skills.
+Same-named collisions use the first source: project Agent Skills override project ForgeRelay Skills, which override system ForgeRelay Skills and explicit additional paths.
 
 When a task matches an advertised skill, read its `SKILL.md` before using other
 files in the skill directory.

package/docs/configuration.md

@@ -910,20 +910,19 @@ select a global instruction file; its `skills` child is an additional Agent Skil
 | --- | --- |
 | `FORGERELAY_SKILLS` | Set to `0` to hide skills. Enabled by default. |
 | `FORGERELAY_SUBAGENTS` | Set to `1` to expose configured subagent profiles. |
-| `FORGERELAY_AGENT_DIR` | Defaults to `~/.codex`; its `skills` child is included as an additional Skill source. |
+| `FORGERELAY_AGENT_DIR` | Defaults to `~/.codex`; used by supported Agent integrations, not as an automatic Skill source. |
 | `FORGERELAY_SKILL_PATHS` | Optional comma-separated additional skill directories. |
 
-Standard Agent Skills are discovered in precedence order from:
+Skills are discovered in precedence order from:
 
 - project `.agents/skills`
-- `~/.agents/skills`
-- the active ForgeRelay config directory's `skills` folder
-- `FORGERELAY_AGENT_DIR/skills`
-- paths from `FORGERELAY_SKILL_PATHS`
+- project `.forgerelay/skills`
+- the active ForgeRelay config directory's `skills` folder (`~/.forgerelay/skills` by default)
+- paths explicitly added through `FORGERELAY_SKILL_PATHS`
 
-The ownership boundaries are different even though all of these are readable Skill sources. Project/global `.agents/skills` belong to the open Agent Skills ecosystem and may contain files or symlinks installed by other Agent tooling. ForgeRelay-owned Skills stay under the active ForgeRelay config directory (`~/.forgerelay/skills` by default); ForgeRelay does not migrate or install its private Skills into `~/.agents/skills`.
+Project `.agents/skills` belongs to the open Agent Skills ecosystem and may contain files or symlinks installed by other Agent tooling. ForgeRelay-owned project/system Skills stay under `.forgerelay/skills` and the active ForgeRelay config directory. Global Agent runtime directories such as `~/.agents/skills` and `FORGERELAY_AGENT_DIR/skills` are not scanned automatically.
 
-When the same Skill name appears in more than one source, the first source wins. Project Skills therefore override same-named global `~/.agents/skills` entries, matching ForgeRelay's project-over-global configuration model.
+When the same Skill name appears in more than one source, the first source wins: project Agent Skills override project ForgeRelay Skills, which override system ForgeRelay Skills and explicit additional paths.
 
 When subagents are enabled, canonical v1.2 profiles are discovered from:
 

package/docs/gotchas.md

@@ -192,15 +192,14 @@ Skills are enabled by default. Check:
 FORGERELAY_SKILLS=1 forgerelay serve
 ```
 
-Standard paths include:
+Standard automatic discovery paths include:
 
 - project `.agents/skills`
-- `~/.agents/skills`
+- project `.forgerelay/skills`
 - active ForgeRelay config `skills` directory (`~/.forgerelay/skills` by default)
-- `FORGERELAY_AGENT_DIR/skills`
-- additional `FORGERELAY_SKILL_PATHS`
+- additional paths explicitly configured through `FORGERELAY_SKILL_PATHS`
 
-`.agents/skills` is an external/open Agent Skill source and may contain symlinks managed by other Agent tooling. ForgeRelay-owned Skills belong under its own config `skills` directory and must not be migrated into `.agents/skills`.
+ForgeRelay does **not** automatically scan global Agent runtime Skill directories such as `~/.agents/skills` or `FORGERELAY_AGENT_DIR/skills`. Project `.agents/skills` remains the open Agent Skills source, while ForgeRelay-owned project/system Skills live under `.forgerelay/skills` and the active ForgeRelay config `skills` directory.
 
 ## Subagent profiles do not appear
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@akira-tl/forgerelay",
-  "version": "1.2.0",
+  "version": "1.2.2",
   "description": "Local development control plane for MCP coding agents.",
   "type": "module",
   "homepage": "https://github.com/Akira-TL/forgerelay#readme",
@@ -67,7 +67,7 @@
     "release:push-ready": "node scripts/release/push-ready.mjs",
     "postinstall": "node scripts/fix-node-pty-permissions.mjs",
     "start": "node dist/cli.js serve",
-    "test": "node --test scripts/debug/runtime.test.mjs scripts/config/schema-text.test.mjs scripts/release-proof.test.mjs scripts/release/release-gate.test.mjs scripts/release/push-ready.test.mjs scripts/release/release-version.test.mjs && tsx src/mcp/oauth/router.test.ts && tsx src/workspaces/relay/auth/remote-auth-cli.test.ts && tsx src/workspaces/relay/auth/remote-ssh-auth-cli.test.ts && tsx src/workspaces/relay/tests/lifecycle.test.ts && tsx src/workspaces/relay/tests/routing.test.ts && tsx src/workspaces/relay/tests/ssh.test.ts && tsx src/workspaces/relay/tests/process.test.ts && tsx src/workspaces/relay/tests/recovery.test.ts && tsx src/workspaces/relay/tests/checkpoint.test.ts && tsx src/runtime/config/definition/schema.test.ts && tsx src/runtime/config/resolution/resolver.test.ts && tsx src/runtime/security/project-execution-trust.test.ts && tsx src/runtime/config/resolution/hooks.test.ts && tsx src/workspaces/state/project-context.test.ts && tsx src/runtime/config/config.test.ts && tsx src/runtime/config/external-mcp-registry.test.ts && tsx src/runtime/config/external-mcp-auth-store.test.ts && tsx src/mcp/operations/external-mcp/external-mcp-oauth.test.ts && tsx src/cli/mcp/status.test.ts && tsx src/cli/mcp/diagnostics.test.ts && tsx src/cli/mcp/external-mcp.test.ts && tsx src/runtime/shell/command-shell-runtime.test.ts && tsx src/runtime/instructions/shell-instructions.test.ts && tsx src/runtime/instructions/powershell-skill.test.ts && tsx src/cli/shell/setup.test.ts && tsx src/lsp/language-server-config.test.ts && tsx src/lsp/runtime/managed-language-servers.test.ts && tsx src/lsp/normalization/hover.test.ts && tsx src/lsp/references.server.test.ts && tsx src/lsp/operations/document-symbols.server.test.ts && tsx src/lsp/operations/workspace-symbols.server.test.ts && tsx src/lsp/operations/diagnostics-push.server.test.ts && tsx src/lsp/operations/diagnostics-pull.server.test.ts && tsx src/lsp/operations/request-hardening.server.test.ts && tsx src/lsp/operations/recovery.server.test.ts && tsx src/lsp/operations/lifecycle.server.test.ts && tsx src/lsp/operations/project-trust.server.test.ts && tsx src/lsp/runtime/semantic-requests.test.ts && tsx src/runtime/logging/logger.test.ts && tsx src/runtime/logging/proxy-trust.test.ts && tsx src/runtime/state/lock/file-lock.test.ts && tsx src/runtime/state/runtime-lease.test.ts && tsx src/mcp/panel/mcp-app-template.test.ts && tsx src/mcp/hooks/hooks.test.ts && tsx src/mcp/hooks/hooks-trust.test.ts && tsx src/mcp/operations/external-mcp/external-mcp-transform.test.ts && tsx src/mcp/hooks/external-mcp-transform-trust.test.ts && tsx src/mcp/operations/external-mcp/external-mcp-trust.test.ts && tsx src/mcp/server/core/capability-registry.test.ts && tsx src/mcp/server-instructions.test.ts && tsx src/mcp/request-context.test.ts && tsx src/mcp/request-meta.test.ts && tsx src/mcp/artifacts/incoming-artifacts.test.ts && tsx src/mcp/artifacts/artifact-download.test.ts && tsx src/ui/core/card-types.test.ts && tsx src/ui/activity/model.test.ts && tsx src/ui/activity/detail-card.test.ts && tsx src/ui/review/patch-display.test.ts && tsx src/ui/core/tool-display.test.ts && tsx src/mcp/filesystem/apply-patch.test.ts && tsx src/mcp/process/process-platform.test.ts && tsx src/mcp/process/process-sessions.test.ts && tsx src/mcp/server/transport/mcp-sessions.test.ts && tsx src/mcp/server/transport/server-shutdown.test.ts && tsx src/mcp/server/operations/mutation-diagnostics.test.ts && tsx src/mcp/server/operations/hooks.test.ts && tsx src/subagents/providers/adapters/codex.test.ts && tsx src/subagents/providers/adapters/pi.test.ts && tsx src/subagents/providers/registry.test.ts && tsx src/subagents/providers/availability.test.ts && tsx src/subagents/profiles.test.ts && tsx src/subagents/cli-target.test.ts && tsx src/subagents/sessions/store.test.ts && tsx src/subagents/sessions/manager.test.ts && tsx src/subagents/sessions/project-trust.test.ts && tsx src/subagents/sessions/mcp/capability.server.test.ts && tsx src/subagents/sessions/mcp/continuation.server.test.ts && tsx src/subagents/sessions/mcp/lifecycle.server.test.ts && tsx src/subagents/sessions/mcp/reconciliation.server.test.ts && tsx src/subagents/sessions/mcp/routing.server.test.ts && tsx src/mcp/filesystem/roots.test.ts && tsx src/mcp/filesystem/file-mutations.test.ts && tsx src/mcp/operations/edit-preflight.test.ts && tsx src/workspaces/resources/skills.test.ts && tsx src/runtime/state/db/migrations.test.ts && tsx src/workspaces/state/workspace-store.test.ts && tsx src/workspaces/tasks/workspace-tasks.test.ts && tsx src/workspaces/tasks/workspace-task-reminders.test.ts && tsx src/activity/history/audit-store.test.ts && tsx src/activity/history/bash-output-store.test.ts && tsx src/activity/runtime/lifecycle.test.ts && tsx src/activity/history/query-service.test.ts && tsx src/mcp/operations/core-operation-executor.test.ts && tsx src/mcp/operations/bulk-mutation.test.ts && tsx src/mcp/operations/batch/scheduler.test.ts && tsx src/mcp/operations/batch/executor-policy.test.ts && tsx src/workspaces.test.ts && tsx src/workspaces/conversation-checkout.test.ts && tsx src/workspaces/conversation-worktree.test.ts && tsx src/workspaces/git/worktree-recovery.test.ts && tsx src/mcp/server/workspace/workspace-inventory.test.ts && tsx src/mcp/server/workspace/workspace-recovery.test.ts && tsx src/mcp/server/workspace/workspace-checkpoint.test.ts && tsx src/workspaces/review/review-checkpoints.test.ts && tsx src/lsp/code-intelligence.server.test.ts && npm run build:app && tsx src/mcp/process/server.test.ts && tsx src/mcp/panel/server.test.ts && tsx src/mcp/server/server.test.ts && tsx src/mcp/oauth/oauth-store.test.ts && tsx src/cli/maintenance.test.ts && tsx src/cli/maintenance-prune.test.ts && tsx src/cli/cli.test.ts",
+    "test": "node --test scripts/debug/runtime.test.mjs scripts/config/schema-text.test.mjs scripts/release-proof.test.mjs scripts/release/release-gate.test.mjs scripts/release/push-ready.test.mjs scripts/release/release-version.test.mjs && tsx src/mcp/oauth/router.test.ts && tsx src/workspaces/relay/auth/remote-auth-cli.test.ts && tsx src/workspaces/relay/auth/remote-ssh-auth-cli.test.ts && tsx src/workspaces/relay/tests/lifecycle.test.ts && tsx src/workspaces/relay/tests/routing.test.ts && tsx src/workspaces/relay/tests/ssh.test.ts && tsx src/workspaces/relay/tests/process.test.ts && tsx src/workspaces/relay/tests/recovery.test.ts && tsx src/workspaces/relay/tests/checkpoint.test.ts && tsx src/workspaces/relay/tests/composite.test.ts && tsx src/runtime/config/definition/schema.test.ts && tsx src/runtime/config/resolution/resolver.test.ts && tsx src/runtime/security/project-execution-trust.test.ts && tsx src/runtime/config/resolution/hooks.test.ts && tsx src/workspaces/state/project-context.test.ts && tsx src/runtime/config/config.test.ts && tsx src/runtime/config/external-mcp-registry.test.ts && tsx src/runtime/config/external-mcp-auth-store.test.ts && tsx src/mcp/operations/external-mcp/external-mcp-oauth.test.ts && tsx src/cli/mcp/status.test.ts && tsx src/cli/mcp/diagnostics.test.ts && tsx src/cli/mcp/external-mcp.test.ts && tsx src/runtime/shell/command-shell-runtime.test.ts && tsx src/runtime/instructions/shell-instructions.test.ts && tsx src/runtime/instructions/powershell-skill.test.ts && tsx src/cli/shell/setup.test.ts && tsx src/lsp/language-server-config.test.ts && tsx src/lsp/runtime/managed-language-servers.test.ts && tsx src/lsp/normalization/hover.test.ts && tsx src/lsp/references.server.test.ts && tsx src/lsp/operations/document-symbols.server.test.ts && tsx src/lsp/operations/workspace-symbols.server.test.ts && tsx src/lsp/operations/diagnostics-push.server.test.ts && tsx src/lsp/operations/diagnostics-pull.server.test.ts && tsx src/lsp/operations/request-hardening.server.test.ts && tsx src/lsp/operations/recovery.server.test.ts && tsx src/lsp/operations/lifecycle.server.test.ts && tsx src/lsp/operations/project-trust.server.test.ts && tsx src/lsp/runtime/semantic-requests.test.ts && tsx src/runtime/logging/logger.test.ts && tsx src/runtime/logging/proxy-trust.test.ts && tsx src/runtime/state/lock/file-lock.test.ts && tsx src/runtime/state/runtime-lease.test.ts && tsx src/mcp/panel/mcp-app-template.test.ts && tsx src/mcp/hooks/hooks.test.ts && tsx src/mcp/hooks/hooks-trust.test.ts && tsx src/mcp/operations/external-mcp/external-mcp-transform.test.ts && tsx src/mcp/hooks/external-mcp-transform-trust.test.ts && tsx src/mcp/operations/external-mcp/external-mcp-trust.test.ts && tsx src/mcp/server/core/capability-registry.test.ts && tsx src/mcp/server-instructions.test.ts && tsx src/mcp/request-context.test.ts && tsx src/mcp/request-meta.test.ts && tsx src/mcp/artifacts/incoming-artifacts.test.ts && tsx src/mcp/artifacts/artifact-download.test.ts && tsx src/ui/core/card-types.test.ts && tsx src/ui/activity/model.test.ts && tsx src/ui/activity/detail-card.test.ts && tsx src/ui/review/patch-display.test.ts && tsx src/ui/core/tool-display.test.ts && tsx src/mcp/filesystem/apply-patch.test.ts && tsx src/mcp/process/process-platform.test.ts && tsx src/mcp/process/process-sessions.test.ts && tsx src/mcp/server/transport/mcp-sessions.test.ts && tsx src/mcp/server/transport/server-shutdown.test.ts && tsx src/mcp/server/operations/mutation-diagnostics.test.ts && tsx src/mcp/server/operations/hooks.test.ts && tsx src/subagents/providers/adapters/codex.test.ts && tsx src/subagents/providers/adapters/pi.test.ts && tsx src/subagents/providers/registry.test.ts && tsx src/subagents/providers/availability.test.ts && tsx src/subagents/profiles.test.ts && tsx src/subagents/cli-target.test.ts && tsx src/subagents/sessions/store.test.ts && tsx src/subagents/sessions/manager.test.ts && tsx src/subagents/sessions/project-trust.test.ts && tsx src/subagents/sessions/mcp/capability.server.test.ts && tsx src/subagents/sessions/mcp/continuation.server.test.ts && tsx src/subagents/sessions/mcp/lifecycle.server.test.ts && tsx src/subagents/sessions/mcp/reconciliation.server.test.ts && tsx src/subagents/sessions/mcp/routing.server.test.ts && tsx src/mcp/filesystem/roots.test.ts && tsx src/mcp/filesystem/file-mutations.test.ts && tsx src/mcp/operations/edit-preflight.test.ts && tsx src/workspaces/resources/skills.test.ts && tsx src/runtime/state/db/migrations.test.ts && tsx src/workspaces/state/workspace-store.test.ts && tsx src/workspaces/tasks/workspace-tasks.test.ts && tsx src/workspaces/tasks/workspace-task-reminders.test.ts && tsx src/activity/history/audit-store.test.ts && tsx src/activity/history/bash-output-store.test.ts && tsx src/activity/runtime/lifecycle.test.ts && tsx src/activity/history/query-service.test.ts && tsx src/mcp/operations/core-operation-executor.test.ts && tsx src/mcp/operations/bulk-mutation.test.ts && tsx src/mcp/operations/batch/scheduler.test.ts && tsx src/mcp/operations/batch/executor-policy.test.ts && tsx src/workspaces.test.ts && tsx src/workspaces/conversation-checkout.test.ts && tsx src/workspaces/conversation-worktree.test.ts && tsx src/workspaces/git/worktree-recovery.test.ts && tsx src/mcp/server/workspace/workspace-inventory.test.ts && tsx src/mcp/server/workspace/workspace-recovery.test.ts && tsx src/mcp/server/workspace/workspace-checkpoint.test.ts && tsx src/workspaces/review/review-checkpoints.test.ts && tsx src/lsp/code-intelligence.server.test.ts && npm run build:app && tsx src/mcp/process/server.test.ts && tsx src/mcp/panel/server.test.ts && tsx src/mcp/server/server.test.ts && tsx src/mcp/oauth/oauth-store.test.ts && tsx src/cli/maintenance.test.ts && tsx src/cli/maintenance-prune.test.ts && tsx src/cli/cli.test.ts",
     "typecheck": "tsc -p tsconfig.json --noEmit",
     "release:check": "node scripts/release-version.mjs check",
     "release:tag-check": "node scripts/release-version.mjs tag",

package/scripts/debug/relay-accept/support.mjs

@@ -13,6 +13,7 @@ import {
 } from "node:fs";
 import { join, resolve } from "node:path";
 import { setTimeout as delay } from "node:timers/promises";
+import { Client, StreamableHTTPClientTransport } from "@modelcontextprotocol/client";
 import { debugRoot, repoRoot } from "../runtime.mjs";
 
 export function relayAcceptanceTopology() {
@@ -170,6 +171,37 @@ export function toolText(result) {
     .join("\n");
 }
 
+export async function assertStatelessRelayPanel({ mcpUrl, accessToken, executionCheckout, expectedWorkspaceId }) {
+  const transport = new StreamableHTTPClientTransport(new URL(mcpUrl), {
+    requestInit: { headers: { authorization: `Bearer ${accessToken}` } },
+  });
+  const client = new Client(
+    { name: "forgerelay-relay-stateless-acceptance", version: "1.0.0" },
+    { versionNegotiation: { mode: { pin: "2026-07-28" } } },
+  );
+  try {
+    await client.connect(transport);
+    assert.equal(transport.sessionId, undefined);
+    const opened = await client.callTool({
+      name: "open_workspace",
+      arguments: { path: executionCheckout, relay: "execution", context: "none" },
+    });
+    assertToolOk(opened, "open relayed checkout over stateless HTTP");
+    assert.equal(opened.structuredContent.workspaceId, expectedWorkspaceId);
+    const panel = await client.callTool({
+      name: "activity_panel",
+      arguments: { workspaceId: expectedWorkspaceId },
+      _meta: { "dev.forgerelay/conversation": "relay-stateless-panel-acceptance" },
+    });
+    assertToolOk(panel, "render relayed Activity Panel over stateless HTTP");
+    assert.match(String(panel.structuredContent.turnId), /^turn_/);
+    assert.equal(panel._meta?.["forgerelay/activityPanelWorkspace"]?.workspaceId, expectedWorkspaceId);
+  } finally {
+    await client.close().catch(() => undefined);
+  }
+  pass("relay stateless Panel", "relayed open_workspace and activity_panel succeeded across modern stateless MCP requests");
+}
+
 export function pass(label, detail) {
   console.log(`PASS ${label}: ${detail}`);
 }

package/scripts/debug/relay-accept.mjs

@@ -2,23 +2,19 @@ import assert from "node:assert/strict";
 import { spawn, spawnSync } from "node:child_process";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { once } from "node:events";
-import { connect } from "node:net";
-import { existsSync, mkdirSync, readFileSync, readdirSync, rmSync, writeFileSync } from "node:fs";
-import { join, resolve } from "node:path";
+import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
 import { setTimeout as delay } from "node:timers/promises";
-import { debugRoot, repoRoot } from "./runtime.mjs";
-import { relayAcceptanceTopology, assertPortsFree, setupGitProject, runGit, taskStateFiles, findTaskStateFile, assertTaskBodyAbsentFromGateway, assertSafeRelayInspection, installRelayImageFixture, assertRelayedImageResult, assertToolOk, toolText, pass } from "./relay-accept/support.mjs";
-
+import { repoRoot } from "./runtime.mjs";
+import { relayAcceptanceTopology, assertPortsFree, setupGitProject, findTaskStateFile, assertTaskBodyAbsentFromGateway, assertSafeRelayInspection, installRelayImageFixture, assertRelayedImageResult, assertStatelessRelayPanel, assertToolOk, toolText, pass } from "./relay-accept/support.mjs";
 const {
-  gatewayPort, executionPort, gatewayBaseUrl, gatewayMcpUrl, executionBaseUrl,
-  acceptanceRoot, gatewayConfigDir, gatewayStateDir, gatewayWorktreeRoot,
-  gatewayProjects, gatewayLocalProject, executionConfigDir, executionStateDir,
-  executionWorktreeRoot, executionProjects, executionCheckout, executionWorktreeSource,
-  bootstrapSecret, checkoutTaskBody, worktreeTaskBody, compositeMemberTaskBody, compositeTaskBody,
+  gatewayPort, executionPort, gatewayBaseUrl, gatewayMcpUrl, executionBaseUrl, acceptanceRoot,
+  gatewayConfigDir, gatewayStateDir, gatewayWorktreeRoot, gatewayProjects, gatewayLocalProject,
+  executionConfigDir, executionStateDir, executionWorktreeRoot, executionProjects, executionCheckout,
+  executionWorktreeSource, bootstrapSecret, checkoutTaskBody, worktreeTaskBody, compositeMemberTaskBody, compositeTaskBody,
 } = relayAcceptanceTopology();
 const gatewayOwnerToken = randomBytes(32).toString("base64url");
 const executionOwnerToken = randomBytes(32).toString("base64url");
-
 await assertPortsFree([gatewayPort, executionPort]);
 rmSync(acceptanceRoot, { recursive: true, force: true });
 mkdirSync(gatewayLocalProject, { recursive: true });
@@ -30,10 +26,8 @@ writeFileSync(join(gatewayLocalProject, "sentinel.txt"), "gateway-local-content\
 writeFileSync(join(executionCheckout, "sentinel.txt"), "execution-remote-content\n");
 writeFileSync(join(executionCheckout, "AGENTS.md"), `${bootstrapSecret}\n`);
 setupGitProject(executionWorktreeSource);
-
 writeAuthFile(gatewayConfigDir, gatewayOwnerToken, "relay-acceptance-gateway");
 writeAuthFile(executionConfigDir, executionOwnerToken, "relay-acceptance-execution");
-
 const executionEnv = instanceEnv({
   port: executionPort,
   baseUrl: executionBaseUrl,
@@ -106,6 +100,13 @@ try {
   assert.equal(openedB.structuredContent.workspaceId, checkoutRelayId);
   pass("relay persistent identity", `two Gateway conversations reused ${checkoutRelayId}`);
 
+  await assertStatelessRelayPanel({
+    mcpUrl: gatewayMcpUrl,
+    accessToken: oauth.accessToken,
+    executionCheckout,
+    expectedWorkspaceId: checkoutRelayId,
+  });
+
   assertRelayedImageResult(callTool(gatewayMcpUrl, oauth.accessToken, sessionB, nextId(), "read", {
     workspaceId: checkoutRelayId, path: "relay-image.png",
   }, conversationB), relayImageBase64, gatewayStateDir);