@auctra/mcp-gateway 0.1.5 → 0.1.7

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@auctra/mcp-gateway",
-  "version": "0.1.5",
+  "version": "0.1.7",
   "description": "MCP gateway — gate tool calls and MCP/skill installs through Auctra action.execute",
   "type": "module",
   "main": "./src/index.js",

package/src/index.js

@@ -181,6 +181,39 @@ export async function gateMcpToolCall(input) {
     throw new McpToolBlockedError(message, result.decision, result.evidence);
   }
 
+  const requireLease = process.env.AUCTRA_REQUIRE_EXECUTION_LEASE === "1";
+  const leaseToken = result.execution_lease?.token;
+  if (requireLease || leaseToken) {
+    if (!leaseToken) {
+      throw new McpToolBlockedError(
+        "execution lease required but action.execute returned none — configure AUCTRA_EXECUTION_LEASE_SECRET",
+        "blocked",
+        result.evidence,
+      );
+    }
+    if (!input.client.executionLease?.consume) {
+      if (requireLease) {
+        throw new McpToolBlockedError(
+          "executionLease.consume client method required when AUCTRA_REQUIRE_EXECUTION_LEASE=1",
+          "blocked",
+          result.evidence,
+        );
+      }
+    } else {
+      const consumed = await input.client.executionLease.consume({
+        lease: leaseToken,
+        expectedActionType: resolveActionType(input),
+      });
+      if (!consumed.ok) {
+        throw new McpToolBlockedError(
+          consumed.error ?? "execution lease consume failed",
+          "blocked",
+          result.evidence,
+        );
+      }
+    }
+  }
+
   return result;
 }
 

package/src/index.ts

@@ -18,6 +18,12 @@ export type ExecuteActionClient = {
       decision: "allowed" | "blocked" | "require_approval";
       reason: string;
       action_request_id?: string;
+      execution_lease?: {
+        token: string;
+        expires_at: string;
+        action_request_id: string;
+        action_type: string;
+      } | null;
       evidence?: {
         format: string;
         payload_hash: string;
@@ -26,6 +32,13 @@ export type ExecuteActionClient = {
       evidence_payload?: { evidence_id?: string };
     }>;
   };
+  /** Optional — required when AUCTRA_REQUIRE_EXECUTION_LEASE=1 */
+  executionLease?: {
+    consume(input: {
+      lease: string;
+      expectedActionType?: string;
+    }): Promise<{ ok: boolean; error?: string; reason_codes?: string[] }>;
+  };
 };
 
 /** @deprecated Use ExecuteActionClient — kept as type alias for migration notes only */
@@ -314,6 +327,39 @@ export async function gateMcpToolCall(input: McpToolGateInput) {
     throw new McpToolBlockedError(message, result.decision, result.evidence);
   }
 
+  const requireLease = process.env.AUCTRA_REQUIRE_EXECUTION_LEASE === "1";
+  const leaseToken = result.execution_lease?.token;
+  if (requireLease || leaseToken) {
+    if (!leaseToken) {
+      throw new McpToolBlockedError(
+        "execution lease required but action.execute returned none — configure AUCTRA_EXECUTION_LEASE_SECRET",
+        "blocked",
+        result.evidence,
+      );
+    }
+    if (!input.client.executionLease?.consume) {
+      if (requireLease) {
+        throw new McpToolBlockedError(
+          "executionLease.consume client method required when AUCTRA_REQUIRE_EXECUTION_LEASE=1",
+          "blocked",
+          result.evidence,
+        );
+      }
+    } else {
+      const consumed = await input.client.executionLease.consume({
+        lease: leaseToken,
+        expectedActionType: resolveActionType(input),
+      });
+      if (!consumed.ok) {
+        throw new McpToolBlockedError(
+          consumed.error ?? "execution lease consume failed",
+          "blocked",
+          result.evidence,
+        );
+      }
+    }
+  }
+
   return result;
 }