@bnbagent/studio-cli 0.0.9 → 0.0.11-alpha.1

package/recipes/runtimes/azure-foundry/code/{{PKG}}/mcpMain.ts.tmpl

@@ -1,19 +1,12 @@
 /**
  * Single MCP seller agent entrypoint (the `--protocol MCP` peer to main.ts).
  *
- * The x402 seller is intentionally dormant on Azure Foundry in v1. Use the
- * platform deployment target for the anonymous HTTP-envelope tunnel.
- *
  * This is the VALUABLE agent AND the SOLE key-holder/signer, serving its
- * seller surface over the **Model Context Protocol** instead of A2A. The MCP
- * server is cloud-neutral: a streamable-HTTP MCP server on `0.0.0.0:8000/mcp`
- * (port 8000, `AGENT_PORT` overrides locally) with no cloud-vendor serving
- * dependency. `bag dev` runs `node mcpMain.js` directly. There is no separate
- * forwarding service — the agent IS the seller.
- *
- * (For the azure-foundry runtime, the DEPLOY host speaks the Invocations
- * protocol — `foundryMain.ts`. This MCP entrypoint is for LOCAL run / dev and
- * the eventual cross-cloud transport.)
+ * seller surface over the **Model Context Protocol** instead of A2A. AWS
+ * Bedrock AgentCore hosts MCP natively: it expects a streamable-HTTP MCP
+ * server on `0.0.0.0:8000/mcp` and wraps the protocol (session isolation,
+ * inbound OAuth/Cognito auth, scale-to-zero) exactly as it does for A2A.
+ * There is no separate forwarding service — the agent IS the seller.
  *
  * MCP tools (all backed by signing.ts fixed code — NEVER LLM-callable):
  *
@@ -26,14 +19,16 @@
  *     + the read-only chain tools (wallet / balances / ERC-8004 / ERC-8183 /
  *       block / tx / contract-view), so an MCP client can inspect state.
  *
- * ## How delivery works under MCP (synchronous)
+ * ## How delivery works under MCP (synchronous, ≤ ~15 min)
  *
- * A2A acks then finishes the work + on-chain `submit` in a background task.
- * An MCP server has no such ack-then-continue hook, so under MCP the
- * long-running pattern is **synchronous**: `notify_funded` does the whole
- * verify → LLM work → submit **inside the single tool invocation**, using
- * MCP progress notifications as a heartbeat to keep the connection alive
- * across the steps. The runtime is
+ * A2A acks then finishes the work + on-chain `submit` in a background task
+ * kept alive by reporting `HEALTHY_BUSY` to AgentCore's `/ping`. An MCP
+ * server has no such hook (its only liveness is the platform's `/mcp/`
+ * probe). So under MCP the documented long-running pattern is
+ * **synchronous**: `notify_funded` does the whole verify → LLM work → submit
+ * **inside the single tool invocation** (AgentCore allows a synchronous
+ * request to run up to ~15 minutes), using MCP progress notifications as a
+ * heartbeat to keep the connection alive across the steps. The runtime is
  * therefore **stateful** (per-session `StreamableHTTPServerTransport`,
  * routed by `Mcp-Session-Id`) so progress notifications work. Node's async
  * chain/signing calls never block the event loop, so the platform's
@@ -51,17 +46,33 @@
  *
  * You own this file — specialise the work prompt / dispatch, but keep signing
  * bounded to these two ops and keep the read tools read-only.
+ * In dual-face mode this file is imported as a library by dualMain.ts; main()
+ * runs only when mcpMain itself is the selected entrypoint.
  */
 
-import { randomUUID } from "node:crypto";
+import { createHash, randomUUID } from "node:crypto";
 import { pathToFileURL } from "node:url";
-import { loadStudioToml } from "@bnbagent/studio-runtime/config";
+import {
+  GetSecretValueCommand,
+  SecretsManagerClient,
+} from "@aws-sdk/client-secrets-manager";
+import {
+  loadStudioToml,
+  type TomlTable,
+} from "@bnbagent/studio-runtime/config";
 import * as cr from "@bnbagent/studio-runtime/tools";
 import {
   ensureAltanaSessionLoaded,
   ensureKeystoreMaterialized,
   ensureTwakMaterialized,
+  getWallet,
 } from "@bnbagent/studio-runtime/wallet";
+import {
+  createEnvelopeMiddleware,
+  X402_SELL_PATH,
+  type X402HttpRequest,
+  X402Seller,
+} from "@bnbagent/studio-runtime/x402";
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
 import { isInitializeRequest } from "@modelcontextprotocol/sdk/types.js";
@@ -77,6 +88,39 @@ const log = {
     console.error(`[seller-agent.mcp] ERROR ${msg}`, e ?? ""),
 };
 
+// ── Runtime secrets ───────────────────────────────────────────────────────────
+// Keep plaintext secrets OUT of agentcore.json. When BNBAGENT_RUNTIME_SECRET_ID
+// is set (deployed runtime), pull a JSON {ENV_NAME: value} blob from AWS
+// Secrets Manager into the process env BEFORE anything reads it. No-op
+// locally. In a deployed runtime the managed secret bundle is authoritative
+// and replaces any stale spec-level value left by an earlier revision.
+async function loadRuntimeSecrets(): Promise<void> {
+  const secretId = process.env.BNBAGENT_RUNTIME_SECRET_ID;
+  if (!secretId) {
+    return;
+  }
+  const resp = await new SecretsManagerClient({}).send(
+    new GetSecretValueCommand({ SecretId: secretId }),
+  );
+  const bundle = JSON.parse(resp.SecretString ?? "{}") as Record<
+    string,
+    unknown
+  >;
+  for (const [key, value] of Object.entries(bundle)) {
+    process.env[key] = String(value);
+  }
+  const pieverseKey = process.env.PIEVERSE_LLM_API_KEY;
+  if (pieverseKey) {
+    const fingerprint = createHash("sha256")
+      .update(pieverseKey, "utf-8")
+      .digest("hex")
+      .slice(0, 12);
+    log.info(
+      `runtime secret PIEVERSE_LLM_API_KEY source=secretsmanager sha256=${fingerprint}…`,
+    );
+  }
+}
+
 /**
  * The project-wide default network (`[network].default`) — tool calls that
  * omit `network` fall back to it, never to a hardcoded name.
@@ -110,10 +154,40 @@ function generatorTag(): string {
     : name || APP_NAME;
 }
 
-// ── LLM work hook (lazy: built on first delivery; negotiate never needs it) ──
-// Deferred construction keeps the negotiate-only path (and a cold start that
-// only quotes) from building the model, and keeps this module importable
-// without the provider env until a deliverable is actually produced.
+function hasErc8183Rail(cfg: TomlTable): boolean {
+  const payments = asTable(cfg.payments);
+  return asTable(payments?.erc8183) !== null;
+}
+
+function asTable(value: unknown): TomlTable | null {
+  return value !== null && typeof value === "object" && !Array.isArray(value)
+    ? (value as TomlTable)
+    : null;
+}
+
+function flatHeaders(
+  headers: Record<string, string | string[] | undefined>,
+): Record<string, string> {
+  const out: Record<string, string> = {};
+  for (const [name, value] of Object.entries(headers)) {
+    if (typeof value === "string") out[name] = value;
+    else if (value !== undefined) out[name] = value[0] ?? "";
+  }
+  return out;
+}
+
+function flatQuery(query: Record<string, unknown>): Record<string, string> {
+  const out: Record<string, string> = {};
+  for (const [name, value] of Object.entries(query)) {
+    if (typeof value === "string") out[name] = value;
+  }
+  return out;
+}
+
+// ── LLM work hook (lazy: built on first authorized task) ─────────────────────
+// Deferred construction keeps negotiate and unpaid x402 quote paths from
+// building the model, and keeps this module importable without the provider
+// env until a deliverable is actually produced.
 type RunLlm = (prompt: string) => Promise<string>;
 let cachedRunLlm: RunLlm | null = null;
 
@@ -126,7 +200,9 @@ async function runLlm(prompt: string): Promise<string> {
       const result = await generateText({
         model,
         system:
-          "You are a seller agent. You do the actual work once a job is funded. " +
+          "You are a seller agent. The runtime has already authorized this task " +
+          "through its configured commerce rail. Complete the user's task now; " +
+          "do not ask for a job ID or additional payment. " +
           "Be concrete and concise. Use the read-only chain tools when on-chain " +
           "context helps. If a paid-data tool such as `buy_with_x402` is " +
           "available to you, USE IT to fetch the data a task needs — those " +
@@ -194,12 +270,15 @@ async function reportProgress(
   });
 }
 
-/** Build the seller MCP server: 2 commerce tools + the read-only chain tools. */
-export function buildMcpServer(): McpServer {
+/** Build the seller MCP server, gating commerce tools on the ERC-8183 rail. */
+export function buildMcpServer(
+  opts: { commerceSkills?: boolean } = {},
+): McpServer {
   const server = new McpServer({ name: "bnbagent-seller", version: "1.0.0" });
 
   // ── Commerce tools (signing is FIXED code in signing.ts) ──────────────────
-  server.registerTool(
+  if (opts.commerceSkills !== false) {
+    server.registerTool(
     "negotiate",
     {
       description:
@@ -228,9 +307,9 @@ export function buildMcpServer(): McpServer {
       const clamped = signing.clampPrice(signing.listPrice());
       return toolResult(await signing.signQuote(request, clamped));
     },
-  );
+    );
 
-  server.registerTool(
+    server.registerTool(
     "notify_funded",
     {
       description:
@@ -337,7 +416,8 @@ export function buildMcpServer(): McpServer {
         deliverable_url: res.deliverableUrl,
       });
     },
-  );
+    );
+  }
 
   // ── Read-only chain tools ──────────────────────────────────────────────────
   const network = z.string().optional().describe("studio network name");
@@ -494,22 +574,61 @@ export function buildMcpServer(): McpServer {
 // ── serving ───────────────────────────────────────────────────────────────────
 
 /**
- * Serve the MCP server as **stateful** streamable-HTTP on `/mcp`
- * (0.0.0.0:8000/mcp; `AGENT_PORT` is the local override). Stateful — one
- * transport per `Mcp-Session-Id` — so progress notifications during the
- * multi-step `notify_funded` delivery reach the caller.
+ * Serve the MCP server as **stateful** streamable-HTTP on `/mcp` (the
+ * AgentCore MCP contract: 0.0.0.0:8000/mcp; `AGENT_PORT` is the local
+ * override). Stateful — one transport per `Mcp-Session-Id` — so progress
+ * notifications during the multi-step `notify_funded` delivery reach the
+ * caller; AgentCore routes the session to one microVM via the same header.
  */
 async function main(): Promise<void> {
+  await loadRuntimeSecrets();
+
   // Wallet material is NEVER bundled into the deploy artifact. `bag deploy`
-  // injects it through a Foundry CustomKeys connection before process start;
-  // these calls materialize it on disk before signing. Each is a no-op for
-  // the other wallet kind and locally, where it already lives on disk.
+  // injects it via Secrets Manager and these calls (run once at cold start,
+  // before any signing) materialize it on disk. Each is a no-op for the
+  // other wallet kind and locally, where the wallet already lives on disk.
   ensureKeystoreMaterialized();
   ensureTwakMaterialized();
   await ensureAltanaSessionLoaded();
 
+  const cfg = loadStudioToml();
+  const rails = { erc8183: hasErc8183Rail(cfg) };
+  const host = process.env.AGENT_BIND_HOST || "0.0.0.0";
+  const port = Number(process.env.AGENT_PORT || "8000");
+  const seller = await X402Seller.create({
+    cfg,
+    runWork: ({ prompt }) => runLlm(prompt),
+    walletAddress: getWallet().address,
+    resourceUrl: `${
+      process.env.AGENTCORE_RUNTIME_URL ?? `http://localhost:${port}`
+    }${X402_SELL_PATH}`,
+  });
+
   const app = express();
-  app.use(express.json());
+
+  if (seller.state !== "disabled") {
+    app.all(
+      X402_SELL_PATH,
+      express.text({ type: "*/*", limit: "1mb" }),
+      async (req, res) => {
+        const request: X402HttpRequest = {
+          method: req.method,
+          path: req.path,
+          query: flatQuery(req.query),
+          headers: flatHeaders(req.headers),
+          body:
+            typeof req.body === "string"
+              ? req.body
+              : JSON.stringify(req.body ?? ""),
+        };
+        const out = await seller.handle(request);
+        res.status(out.status).set(out.headers).send(out.body);
+      },
+    );
+  }
+
+  app.use(express.json({ limit: "8mb" }));
+  app.use(createEnvelopeMiddleware({ port }));
 
   const transports: Record<string, StreamableHTTPServerTransport> = {};
 
@@ -537,14 +656,12 @@ async function main(): Promise<void> {
           delete transports[t.sessionId];
         }
       };
-      await buildMcpServer().connect(t);
+      await buildMcpServer({ commerceSkills: rails.erc8183 }).connect(t);
       transport = t;
     }
     await transport.handleRequest(req, res, req.body);
   });
 
-  const host = process.env.AGENT_BIND_HOST || "0.0.0.0";
-  const port = Number(process.env.AGENT_PORT || "8000");
   app.listen(port, host, () => {
     log.info(`MCP serving on ${host}:${port}/mcp`);
   });