@mhingston5/conduit 1.1.4 → 1.1.6

package/dist/pyodide.worker.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/executors/pyodide.worker.ts"],"sourcesContent":["import { parentPort, workerData } from 'node:worker_threads';\nimport { loadPyodide, type PyodideInterface } from 'pyodide';\nimport net from 'node:net';\n\nlet pyodide: PyodideInterface | null = null;\nlet currentStdout = '';\nlet currentStderr = '';\nlet totalOutputBytes = 0;\nlet totalLogEntries = 0;\nlet currentLimits: any = null;\n\nasync function init() {\n    if (pyodide) return pyodide;\n\n    pyodide = await loadPyodide({\n        stdout: (text) => {\n            if (currentLimits && (totalOutputBytes > (currentLimits.maxOutputBytes || 1024 * 1024) || totalLogEntries > (currentLimits.maxLogEntries || 10000))) {\n                return; // Stop processing logs once limit breached\n            }\n            currentStdout += text + '\\n';\n            totalOutputBytes += text.length + 1;\n            totalLogEntries++;\n        },\n        stderr: (text) => {\n            if (currentLimits && (totalOutputBytes > (currentLimits.maxOutputBytes || 1024 * 1024) || totalLogEntries > (currentLimits.maxLogEntries || 10000))) {\n                return; // Stop processing logs once limit breached\n            }\n            currentStderr += text + '\\n';\n            totalOutputBytes += text.length + 1;\n            totalLogEntries++;\n        },\n    });\n\n    return pyodide;\n}\n\nasync function handleTask(data: any) {\n    const { code, limits, ipcInfo, shim } = data;\n    currentStdout = '';\n    currentStderr = '';\n    totalOutputBytes = 0;\n    totalLogEntries = 0;\n    currentLimits = limits;\n\n    try {\n        const p = await init();\n\n        const sendIPCRequest = async (method: string, params: any) => {\n            if (!ipcInfo?.ipcAddress) throw new Error('Conduit IPC address not configured');\n\n            return new Promise((resolve, reject) => {\n                let client: net.Socket;\n\n                if (ipcInfo.ipcAddress.includes(':')) {\n                    const lastColon = ipcInfo.ipcAddress.lastIndexOf(':');\n                    const host = ipcInfo.ipcAddress.substring(0, lastColon);\n                    const port = ipcInfo.ipcAddress.substring(lastColon + 1);\n\n                    let targetHost = host.replace(/[\\[\\]]/g, '');\n                    if (targetHost === '0.0.0.0' || targetHost === '::' || targetHost === '::1' || targetHost === '') {\n                        targetHost = '127.0.0.1';\n                    }\n\n                    client = net.createConnection({\n                        host: targetHost,\n                        port: parseInt(port)\n                    });\n                } else {\n                    client = net.createConnection({ path: ipcInfo.ipcAddress });\n                }\n\n                const id = Math.random().toString(36).substring(7);\n                const request = {\n                    jsonrpc: '2.0',\n                    id,\n                    method,\n                    params: params || {},\n                    auth: { bearerToken: ipcInfo.ipcToken }\n                };\n\n                client.on('error', (err) => {\n                    reject(err);\n                    client.destroy();\n                });\n\n                client.write(JSON.stringify(request) + '\\n');\n\n                let buffer = '';\n                client.on('data', (data) => {\n                    buffer += data.toString();\n                    // Robust framing: read until we find a complete JSON object on a line\n                    const lines = buffer.split('\\n');\n                    buffer = lines.pop() || ''; // Keep the last partial line\n\n                    for (const line of lines) {\n                        if (!line.trim()) continue;\n                        try {\n                            const response = JSON.parse(line);\n                            if (response.id === id) {\n                                if (response.error) {\n                                    reject(new Error(response.error.message));\n                                } else {\n                                    resolve(response.result);\n                                }\n                                client.end();\n                                return;\n                            }\n                        } catch (e) {\n                            // If parse fails, it might be a partial line that we haven't seen the end of yet\n                            // but since we split by \\n, this shouldn't happen unless the \\n was inside the JSON.\n                            // However, Conduit ensures JSON-RPC is one line.\n                        }\n                    }\n                });\n\n                client.on('end', () => {\n                    if (buffer.trim()) {\n                        try {\n                            const response = JSON.parse(buffer);\n                            if (response.id === id) {\n                                if (response.error) {\n                                    reject(new Error(response.error.message));\n                                } else {\n                                    resolve(response.result);\n                                }\n                            }\n                        } catch (e) { }\n                    }\n                });\n            });\n        };\n\n        (p as any).globals.set('discover_mcp_tools_js', (options: any) => {\n            return sendIPCRequest('mcp_discover_tools', options);\n        });\n\n        (p as any).globals.set('call_mcp_tool_js', (name: string, args: any) => {\n            return sendIPCRequest('mcp_call_tool', { name, arguments: args });\n        });\n\n        if (shim) {\n            await p.runPythonAsync(shim);\n        }\n\n        const result = await p.runPythonAsync(code);\n\n        if (totalOutputBytes > (limits.maxOutputBytes || 1024 * 1024)) {\n            throw new Error('[LIMIT_OUTPUT]');\n        }\n        if (totalLogEntries > (limits.maxLogEntries || 10000)) {\n            throw new Error('[LIMIT_LOG]');\n        }\n\n        parentPort?.postMessage({\n            stdout: currentStdout,\n            stderr: currentStderr,\n            result: String(result),\n            success: true,\n        });\n    } catch (err: any) {\n        let isOutput = err.message.includes('[LIMIT_OUTPUT]');\n        let isLog = err.message.includes('[LIMIT_LOG]');\n\n        // Fallback: check counters if message doesn't match (e.g. wrapped in OSError)\n        if (!isOutput && !isLog && currentLimits) {\n            if (totalOutputBytes > (currentLimits.maxOutputBytes || 1024 * 1024)) {\n                isOutput = true;\n            }\n            // Check specific log limit breach\n            if (totalLogEntries > (currentLimits.maxLogEntries || 10000)) {\n                isLog = true;\n            }\n        }\n\n        parentPort?.postMessage({\n            stdout: currentStdout,\n            stderr: currentStderr,\n            error: err.message,\n            limitBreached: isOutput ? 'output' : (isLog ? 'log' : undefined),\n            success: false,\n        });\n    }\n}\n\nparentPort?.on('message', async (msg) => {\n    if (msg.type === 'execute') {\n        await handleTask(msg.data);\n    } else if (msg.type === 'ping') {\n        parentPort?.postMessage({ type: 'pong' });\n    }\n});\n\n// Signal ready\nparentPort?.postMessage({ type: 'ready' });\n\n"],"mappings":";AAAA,SAAS,kBAA8B;AACvC,SAAS,mBAA0C;AACnD,OAAO,SAAS;AAEhB,IAAI,UAAmC;AACvC,IAAI,gBAAgB;AACpB,IAAI,gBAAgB;AACpB,IAAI,mBAAmB;AACvB,IAAI,kBAAkB;AACtB,IAAI,gBAAqB;AAEzB,eAAe,OAAO;AAClB,MAAI,QAAS,QAAO;AAEpB,YAAU,MAAM,YAAY;AAAA,IACxB,QAAQ,CAAC,SAAS;AACd,UAAI,kBAAkB,oBAAoB,cAAc,kBAAkB,OAAO,SAAS,mBAAmB,cAAc,iBAAiB,OAAS;AACjJ;AAAA,MACJ;AACA,uBAAiB,OAAO;AACxB,0BAAoB,KAAK,SAAS;AAClC;AAAA,IACJ;AAAA,IACA,QAAQ,CAAC,SAAS;AACd,UAAI,kBAAkB,oBAAoB,cAAc,kBAAkB,OAAO,SAAS,mBAAmB,cAAc,iBAAiB,OAAS;AACjJ;AAAA,MACJ;AACA,uBAAiB,OAAO;AACxB,0BAAoB,KAAK,SAAS;AAClC;AAAA,IACJ;AAAA,EACJ,CAAC;AAED,SAAO;AACX;AAEA,eAAe,WAAW,MAAW;AACjC,QAAM,EAAE,MAAM,QAAQ,SAAS,KAAK,IAAI;AACxC,kBAAgB;AAChB,kBAAgB;AAChB,qBAAmB;AACnB,oBAAkB;AAClB,kBAAgB;AAEhB,MAAI;AACA,UAAM,IAAI,MAAM,KAAK;AAErB,UAAM,iBAAiB,OAAO,QAAgB,WAAgB;AAC1D,UAAI,CAAC,SAAS,WAAY,OAAM,IAAI,MAAM,oCAAoC;AAE9E,aAAO,IAAI,QAAQ,CAAC,SAAS,WAAW;AACpC,YAAI;AAEJ,YAAI,QAAQ,WAAW,SAAS,GAAG,GAAG;AAClC,gBAAM,YAAY,QAAQ,WAAW,YAAY,GAAG;AACpD,gBAAM,OAAO,QAAQ,WAAW,UAAU,GAAG,SAAS;AACtD,gBAAM,OAAO,QAAQ,WAAW,UAAU,YAAY,CAAC;AAEvD,cAAI,aAAa,KAAK,QAAQ,WAAW,EAAE;AAC3C,cAAI,eAAe,aAAa,eAAe,QAAQ,eAAe,SAAS,eAAe,IAAI;AAC9F,yBAAa;AAAA,UACjB;AAEA,mBAAS,IAAI,iBAAiB;AAAA,YAC1B,MAAM;AAAA,YACN,MAAM,SAAS,IAAI;AAAA,UACvB,CAAC;AAAA,QACL,OAAO;AACH,mBAAS,IAAI,iBAAiB,EAAE,MAAM,QAAQ,WAAW,CAAC;AAAA,QAC9D;AAEA,cAAM,KAAK,KAAK,OAAO,EAAE,SAAS,EAAE,EAAE,UAAU,CAAC;AACjD,cAAM,UAAU;AAAA,UACZ,SAAS;AAAA,UACT;AAAA,UACA;AAAA,UACA,QAAQ,UAAU,CAAC;AAAA,UACnB,MAAM,EAAE,aAAa,QAAQ,SAAS;AAAA,QAC1C;AAEA,eAAO,GAAG,SAAS,CAAC,QAAQ;AACxB,iBAAO,GAAG;AACV,iBAAO,QAAQ;AAAA,QACnB,CAAC;AAED,eAAO,MAAM,KAAK,UAAU,OAAO,IAAI,IAAI;AAE3C,YAAI,SAAS;AACb,eAAO,GAAG,QAAQ,CAACA,UAAS;AACxB,oBAAUA,MAAK,SAAS;AAExB,gBAAM,QAAQ,OAAO,MAAM,IAAI;AAC/B,mBAAS,MAAM,IAAI,KAAK;AAExB,qBAAW,QAAQ,OAAO;AACtB,gBAAI,CAAC,KAAK,KAAK,EAAG;AAClB,gBAAI;AACA,oBAAM,WAAW,KAAK,MAAM,IAAI;AAChC,kBAAI,SAAS,OAAO,IAAI;AACpB,oBAAI,SAAS,OAAO;AAChB,yBAAO,IAAI,MAAM,SAAS,MAAM,OAAO,CAAC;AAAA,gBAC5C,OAAO;AACH,0BAAQ,SAAS,MAAM;AAAA,gBAC3B;AACA,uBAAO,IAAI;AACX;AAAA,cACJ;AAAA,YACJ,SAAS,GAAG;AAAA,YAIZ;AAAA,UACJ;AAAA,QACJ,CAAC;AAED,eAAO,GAAG,OAAO,MAAM;AACnB,cAAI,OAAO,KAAK,GAAG;AACf,gBAAI;AACA,oBAAM,WAAW,KAAK,MAAM,MAAM;AAClC,kBAAI,SAAS,OAAO,IAAI;AACpB,oBAAI,SAAS,OAAO;AAChB,yBAAO,IAAI,MAAM,SAAS,MAAM,OAAO,CAAC;AAAA,gBAC5C,OAAO;AACH,0BAAQ,SAAS,MAAM;AAAA,gBAC3B;AAAA,cACJ;AAAA,YACJ,SAAS,GAAG;AAAA,YAAE;AAAA,UAClB;AAAA,QACJ,CAAC;AAAA,MACL,CAAC;AAAA,IACL;AAEA,IAAC,EAAU,QAAQ,IAAI,yBAAyB,CAAC,YAAiB;AAC9D,aAAO,eAAe,sBAAsB,OAAO;AAAA,IACvD,CAAC;AAED,IAAC,EAAU,QAAQ,IAAI,oBAAoB,CAAC,MAAc,SAAc;AACpE,aAAO,eAAe,iBAAiB,EAAE,MAAM,WAAW,KAAK,CAAC;AAAA,IACpE,CAAC;AAED,QAAI,MAAM;AACN,YAAM,EAAE,eAAe,IAAI;AAAA,IAC/B;AAEA,UAAM,SAAS,MAAM,EAAE,eAAe,IAAI;AAE1C,QAAI,oBAAoB,OAAO,kBAAkB,OAAO,OAAO;AAC3D,YAAM,IAAI,MAAM,gBAAgB;AAAA,IACpC;AACA,QAAI,mBAAmB,OAAO,iBAAiB,MAAQ;AACnD,YAAM,IAAI,MAAM,aAAa;AAAA,IACjC;AAEA,gBAAY,YAAY;AAAA,MACpB,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR,QAAQ,OAAO,MAAM;AAAA,MACrB,SAAS;AAAA,IACb,CAAC;AAAA,EACL,SAAS,KAAU;AACf,QAAI,WAAW,IAAI,QAAQ,SAAS,gBAAgB;AACpD,QAAI,QAAQ,IAAI,QAAQ,SAAS,aAAa;AAG9C,QAAI,CAAC,YAAY,CAAC,SAAS,eAAe;AACtC,UAAI,oBAAoB,cAAc,kBAAkB,OAAO,OAAO;AAClE,mBAAW;AAAA,MACf;AAEA,UAAI,mBAAmB,cAAc,iBAAiB,MAAQ;AAC1D,gBAAQ;AAAA,MACZ;AAAA,IACJ;AAEA,gBAAY,YAAY;AAAA,MACpB,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR,OAAO,IAAI;AAAA,MACX,eAAe,WAAW,WAAY,QAAQ,QAAQ;AAAA,MACtD,SAAS;AAAA,IACb,CAAC;AAAA,EACL;AACJ;AAEA,YAAY,GAAG,WAAW,OAAO,QAAQ;AACrC,MAAI,IAAI,SAAS,WAAW;AACxB,UAAM,WAAW,IAAI,IAAI;AAAA,EAC7B,WAAW,IAAI,SAAS,QAAQ;AAC5B,gBAAY,YAAY,EAAE,MAAM,OAAO,CAAC;AAAA,EAC5C;AACJ,CAAC;AAGD,YAAY,YAAY,EAAE,MAAM,QAAQ,CAAC;","names":["data"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mhingston5/conduit",
-  "version": "1.1.4",
+  "version": "1.1.6",
   "type": "module",
   "description": "A secure Code Mode execution substrate for MCP agents",
   "main": "index.js",

package/src/auth.cmd.ts

@@ -2,22 +2,143 @@ import Fastify from 'fastify';
 import axios from 'axios';
 import open from 'open';
 import { v4 as uuidv4 } from 'uuid';
+import crypto from 'node:crypto';
 
 export interface AuthOptions {
-    authUrl: string;
-    tokenUrl: string;
+    authUrl?: string;
+    tokenUrl?: string;
     clientId: string;
-    clientSecret: string;
+    clientSecret?: string;
     scopes?: string;
     port?: number;
+    mcpUrl?: string;
+    usePkce?: boolean;
+}
+
+type DiscoveredOAuth = {
+    authUrl: string;
+    tokenUrl: string;
+    scopes?: string[];
+    resource?: string;
+};
+
+const AUTH_REQUEST_PAYLOAD = {
+    jsonrpc: '2.0',
+    id: 'conduit-auth',
+    method: 'initialize',
+    params: {
+        clientInfo: {
+            name: 'conduit-auth',
+            version: '1.0.0',
+        },
+    },
+};
+
+function base64UrlEncode(buffer: Buffer): string {
+    return buffer
+        .toString('base64')
+        .replace(/\+/g, '-')
+        .replace(/\//g, '_')
+        .replace(/=+$/g, '');
+}
+
+function createCodeVerifier(): string {
+    return base64UrlEncode(crypto.randomBytes(32));
+}
+
+function createCodeChallenge(verifier: string): string {
+    return base64UrlEncode(crypto.createHash('sha256').update(verifier).digest());
+}
+
+function parseResourceMetadataHeader(headerValue: string | string[] | undefined): string | null {
+    if (!headerValue) return null;
+    const header = Array.isArray(headerValue) ? headerValue.join(',') : headerValue;
+    const match = header.match(/resource_metadata="([^"]+)"/i) || header.match(/resource_metadata=([^, ]+)/i);
+    return match ? match[1] : null;
+}
+
+async function discoverOAuthFromMcp(mcpUrl: string): Promise<DiscoveredOAuth> {
+    const attempts = [
+        () => axios.get(mcpUrl, { validateStatus: () => true }),
+        () => axios.post(mcpUrl, AUTH_REQUEST_PAYLOAD, { validateStatus: () => true }),
+    ];
+
+    let resourceMetadataUrl: string | null = null;
+    for (const attempt of attempts) {
+        const response = await attempt();
+        resourceMetadataUrl = parseResourceMetadataHeader(response.headers['www-authenticate']);
+        if (resourceMetadataUrl) break;
+    }
+
+    if (!resourceMetadataUrl) {
+        throw new Error('Unable to discover OAuth metadata (missing WWW-Authenticate resource_metadata)');
+    }
+
+    const metadataResponse = await axios.get(resourceMetadataUrl);
+    const metadata = metadataResponse.data as Record<string, any>;
+
+    let authUrl = metadata.authorization_endpoint as string | undefined;
+    let tokenUrl = metadata.token_endpoint as string | undefined;
+    let scopes = Array.isArray(metadata.scopes_supported) ? metadata.scopes_supported : undefined;
+    const resource = typeof metadata.resource === 'string' ? metadata.resource : undefined;
+
+    if (!authUrl || !tokenUrl) {
+        const authServer = (Array.isArray(metadata.authorization_servers) && metadata.authorization_servers[0]) || metadata.issuer;
+        if (!authServer) {
+            throw new Error('OAuth metadata did not include authorization server info');
+        }
+
+        const asMetadataUrl = new URL('/.well-known/oauth-authorization-server', authServer).toString();
+        const asMetadataResponse = await axios.get(asMetadataUrl);
+        const asMetadata = asMetadataResponse.data as Record<string, any>;
+
+        authUrl = authUrl || (asMetadata.authorization_endpoint as string | undefined);
+        tokenUrl = tokenUrl || (asMetadata.token_endpoint as string | undefined);
+        scopes = scopes || (Array.isArray(asMetadata.scopes_supported) ? asMetadata.scopes_supported : undefined);
+    }
+
+    if (!authUrl || !tokenUrl) {
+        throw new Error('OAuth discovery failed: missing authorization or token endpoint');
+    }
+
+    return { authUrl, tokenUrl, scopes, resource };
+}
+
+function normalizeScopes(rawScopes?: string): string | undefined {
+    if (!rawScopes) return undefined;
+    return rawScopes
+        .split(',')
+        .map(scope => scope.trim())
+        .filter(Boolean)
+        .join(' ');
 }
 
 export async function handleAuth(options: AuthOptions) {
     const port = options.port || 3333;
     const redirectUri = `http://localhost:${port}/callback`;
     const state = uuidv4();
+    const codeVerifier = options.usePkce ? createCodeVerifier() : undefined;
+    const codeChallenge = codeVerifier ? createCodeChallenge(codeVerifier) : undefined;
 
     const fastify = Fastify();
+    let resolvedScopes = normalizeScopes(options.scopes);
+    let resolvedAuthUrl = options.authUrl;
+    let resolvedTokenUrl = options.tokenUrl;
+    let resolvedResource: string | undefined;
+
+    if (options.mcpUrl) {
+        const discovered = await discoverOAuthFromMcp(options.mcpUrl);
+        resolvedAuthUrl = discovered.authUrl;
+        resolvedTokenUrl = discovered.tokenUrl;
+        resolvedResource = discovered.resource;
+        if (!resolvedScopes && discovered.scopes && discovered.scopes.length > 0) {
+            resolvedScopes = discovered.scopes.join(' ');
+        }
+    }
+
+    if (!resolvedAuthUrl || !resolvedTokenUrl) {
+        throw new Error('OAuth configuration missing authUrl or tokenUrl (set --mcp-url or provide both)');
+    }
 
     return new Promise<void>((resolve, reject) => {
         fastify.get('/callback', async (request, reply) => {
@@ -36,12 +157,26 @@ export async function handleAuth(options: AuthOptions) {
             }
 
             try {
-                const response = await axios.post(options.tokenUrl, {
-                    grant_type: 'authorization_code',
-                    code,
-                    redirect_uri: redirectUri,
-                    client_id: options.clientId,
-                    client_secret: options.clientSecret,
+                const body = new URLSearchParams();
+                body.set('grant_type', 'authorization_code');
+                body.set('code', code);
+                body.set('redirect_uri', redirectUri);
+                body.set('client_id', options.clientId);
+                if (options.clientSecret) {
+                    body.set('client_secret', options.clientSecret);
+                }
+                if (codeVerifier) {
+                    body.set('code_verifier', codeVerifier);
+                }
+                if (resolvedResource) {
+                    body.set('resource', resolvedResource);
+                }
+
+                const response = await axios.post(resolvedTokenUrl, body, {
+                    headers: {
+                        'Content-Type': 'application/x-www-form-urlencoded',
+                        'Accept': 'application/json',
+                    },
                 });
 
                 const { refresh_token, access_token } = response.data;
@@ -51,9 +186,14 @@ export async function handleAuth(options: AuthOptions) {
                 console.log('credentials:');
                 console.log('  type: oauth2');
                 console.log(`  clientId: ${options.clientId}`);
-                console.log(`  clientSecret: ${options.clientSecret}`);
-                console.log(`  tokenUrl: "${options.tokenUrl}"`);
+                if (options.clientSecret) {
+                    console.log(`  clientSecret: ${options.clientSecret}`);
+                }
+                console.log(`  tokenUrl: "${resolvedTokenUrl}"`);
                 console.log(`  refreshToken: "${refresh_token || 'N/A (No refresh token returned)'}"`);
+                if (resolvedScopes) {
+                    console.log(`  scopes: ["${resolvedScopes.split(' ').join('", "')}"]`);
+                }
 
                 if (!refresh_token) {
                     console.log('\nWarning: No refresh token was returned. Ensure your app has "offline_access" scope or similar.');
@@ -78,13 +218,20 @@ export async function handleAuth(options: AuthOptions) {
                 return;
             }
 
-            const authUrl = new URL(options.authUrl);
+            const authUrl = new URL(resolvedAuthUrl);
             authUrl.searchParams.append('client_id', options.clientId);
             authUrl.searchParams.append('redirect_uri', redirectUri);
             authUrl.searchParams.append('response_type', 'code');
             authUrl.searchParams.append('state', state);
-            if (options.scopes) {
-                authUrl.searchParams.append('scope', options.scopes);
+            if (resolvedScopes) {
+                authUrl.searchParams.append('scope', resolvedScopes);
+            }
+            if (codeChallenge) {
+                authUrl.searchParams.append('code_challenge', codeChallenge);
+                authUrl.searchParams.append('code_challenge_method', 'S256');
+            }
+            if (resolvedResource) {
+                authUrl.searchParams.append('resource', resolvedResource);
             }
 
             console.log(`Opening browser to: ${authUrl.toString()}`);

package/src/core/config.service.ts

@@ -134,10 +134,14 @@ export class ConfigService {
             (fs.existsSync(path.resolve(process.cwd(), 'conduit.yaml')) ? 'conduit.yaml' :
                 (fs.existsSync(path.resolve(process.cwd(), 'conduit.json')) ? 'conduit.json' : null));
 
-        if (!configPath) return {};
+        if (!configPath) {
+            console.warn(`[Conduit] No config file found in ${process.cwd()}. Running with default settings.`);
+            return {};
+        }
 
         try {
             const fullPath = path.resolve(process.cwd(), configPath);
+            console.error(`[Conduit] Loading config from ${fullPath}`);
             let fileContent = fs.readFileSync(fullPath, 'utf-8');
 
             // Env var substitution: ${VAR} or ${VAR:-default}

package/src/core/execution.service.ts

@@ -137,17 +137,22 @@ export class ExecutionService {
         const packages = await this.gatewayService.listToolPackages();
         const allBindings = [];
 
+        this.logger.debug({ packageCount: packages.length, packages: packages.map(p => p.id) }, 'Fetching tool bindings');
+
         for (const pkg of packages) {
             try {
                 // Determine if we need to fetch tools for this package
                 // Optimization: if allowedTools is strict, we could filter packages here
 
                 const stubs = await this.gatewayService.listToolStubs(pkg.id, context);
+                this.logger.debug({ packageId: pkg.id, stubCount: stubs.length }, 'Got stubs from package');
                 allBindings.push(...stubs.map(s => toToolBinding(s.id, undefined, s.description)));
             } catch (err: any) {
                 this.logger.warn({ packageId: pkg.id, err: err.message }, 'Failed to list stubs for package');
             }
         }
+
+        this.logger.info({ totalBindings: allBindings.length }, 'Tool bindings ready for SDK generation');
         return allBindings;
     }
 

package/src/core/policy.service.ts

@@ -66,6 +66,11 @@ export class PolicyService {
                 return true;
             }
 
+            // Improved matching: if pattern has only one part, match it against the tool's name part
+            if (patternParts.length === 1 && toolParts.length > 1) {
+                return patternParts[0] === toolParts[toolParts.length - 1];
+            }
+
             // Exact match: pattern parts must equal tool parts
             if (patternParts.length !== toolParts.length) return false;
             for (let i = 0; i < patternParts.length; i++) {

package/src/core/request.controller.ts

@@ -104,6 +104,9 @@ export class RequestController {
             case 'tools/list': // Standard MCP method name
             case 'mcp_discover_tools':
                 return this.handleDiscoverTools(params, context, id);
+            case 'resources/list':
+            case 'prompts/list':
+                return { jsonrpc: '2.0', id, result: { items: [] } };
             case 'mcp_list_tool_packages':
                 return this.handleListToolPackages(params, context, id);
             case 'mcp_list_tool_stubs':
@@ -125,6 +128,8 @@ export class RequestController {
                 return this.handleInitialize(params, context, id);
             case 'notifications/initialized':
                 return null; // Notifications don't get responses per MCP spec
+            case 'mcp_register_upstream':
+                return this.handleRegisterUpstream(params, context, id);
             case 'ping':
                 return { jsonrpc: '2.0', id, result: {} };
             default:
@@ -135,6 +140,23 @@ export class RequestController {
         }
     }
 
+    private async handleRegisterUpstream(params: any, context: ExecutionContext, id: string | number): Promise<JSONRPCResponse> {
+        if (!params || !params.id || !params.type || (!params.url && !params.command)) {
+            return this.errorResponse(id, -32602, 'Missing registration parameters (id, type, url/command)');
+        }
+
+        try {
+            this.gatewayService.registerUpstream(params);
+            return {
+                jsonrpc: '2.0',
+                id,
+                result: { success: true }
+            };
+        } catch (err: any) {
+            return this.errorResponse(id, -32001, err.message);
+        }
+    }
+
     private async handleDiscoverTools(params: any, context: ExecutionContext, id: string | number): Promise<JSONRPCResponse> {
         const tools = await this.gatewayService.discoverTools(context);
 
@@ -212,20 +234,71 @@ export class RequestController {
         if (!params) return this.errorResponse(id, -32602, 'Missing parameters');
         const { name, arguments: toolArgs } = params;
 
+        const toolId = this.gatewayService.policyService.parseToolName(name);
+        const baseName = toolId.name;
+        const isConduit = toolId.namespace === 'conduit' || toolId.namespace === '';
+
         // Route built-in tools to their specific handlers
-        switch (name) {
-            case 'mcp_execute_typescript':
-                return this.handleExecuteTypeScript(toolArgs, context, id);
-            case 'mcp_execute_python':
-                return this.handleExecutePython(toolArgs, context, id);
-            case 'mcp_execute_isolate':
-                return this.handleExecuteIsolate(toolArgs, context, id);
+        if (isConduit) {
+            switch (baseName) {
+                case 'mcp_execute_typescript':
+                    return this.handleExecuteToolCall('typescript', toolArgs, context, id);
+                case 'mcp_execute_python':
+                    return this.handleExecuteToolCall('python', toolArgs, context, id);
+                case 'mcp_execute_isolate':
+                    return this.handleExecuteToolCall('isolate', toolArgs, context, id);
+            }
         }
 
         const response = await this.gatewayService.callTool(name, toolArgs, context);
         return { ...response, id };
     }
 
+    private formatExecutionResult(result: { stdout: string; stderr: string; exitCode: number | null }) {
+        const structured = {
+            stdout: result.stdout,
+            stderr: result.stderr,
+            exitCode: result.exitCode,
+        };
+        return {
+            content: [{
+                type: 'text',
+                text: JSON.stringify(structured),
+            }],
+            structuredContent: structured,
+        };
+    }
+
+    private async handleExecuteToolCall(
+        mode: 'typescript' | 'python' | 'isolate',
+        params: any,
+        context: ExecutionContext,
+        id: string | number
+    ): Promise<JSONRPCResponse> {
+        if (!params) return this.errorResponse(id, -32602, 'Missing parameters');
+        const { code, limits, allowedTools } = params;
+
+        if (Array.isArray(allowedTools)) {
+            context.allowedTools = allowedTools;
+        }
+
+        const result = mode === 'typescript'
+            ? await this.executionService.executeTypeScript(code, limits, context, allowedTools)
+            : mode === 'python'
+                ? await this.executionService.executePython(code, limits, context, allowedTools)
+                : await this.executionService.executeIsolate(code, limits, context, allowedTools);
+
+        if (result.error) {
+            return this.errorResponse(id, result.error.code, result.error.message);
+        }
+
+        return {
+            jsonrpc: '2.0',
+            id,
+            result: this.formatExecutionResult(result),
+        };
+    }
+
     private async handleExecuteTypeScript(params: any, context: ExecutionContext, id: string | number): Promise<JSONRPCResponse> {
         if (!params) return this.errorResponse(id, -32602, 'Missing parameters');
         const { code, limits, allowedTools } = params;

package/src/executors/pyodide.executor.ts

@@ -94,9 +94,15 @@ export class PyodideExecutor implements Executor {
     }
 
     private createWorker(limits?: ConduitResourceLimits): Worker {
-        let workerPath = path.resolve(__dirname, './pyodide.worker.js');
-        if (!fs.existsSync(workerPath)) {
-            workerPath = path.resolve(__dirname, './pyodide.worker.ts');
+        const candidates = [
+            path.resolve(__dirname, './pyodide.worker.js'),
+            path.resolve(__dirname, './pyodide.worker.ts'),
+            path.resolve(__dirname, './executors/pyodide.worker.js'),
+            path.resolve(__dirname, './executors/pyodide.worker.ts'),
+        ];
+        const workerPath = candidates.find(p => fs.existsSync(p));
+        if (!workerPath) {
+            throw new Error(`Pyodide worker not found. Tried: ${candidates.join(', ')}`);
         }
 
         return new Worker(workerPath, {
@@ -324,4 +330,3 @@ export class PyodideExecutor implements Executor {
         }
     }
 }
-

package/src/gateway/auth.service.ts

@@ -11,6 +11,7 @@ export interface UpstreamCredentials {
     clientSecret?: string;
     tokenUrl?: string;
     refreshToken?: string;
+    scopes?: string[];
 }
 
 interface CachedToken {
@@ -73,26 +74,35 @@ export class AuthService {
     }
 
     private async doRefresh(creds: UpstreamCredentials, cacheKey: string): Promise<string> {
-        if (!creds.tokenUrl || !creds.refreshToken || !creds.clientId || !creds.clientSecret) {
+        if (!creds.tokenUrl || !creds.refreshToken || !creds.clientId) {
             throw new Error('OAuth2 credentials missing required fields for refresh');
         }
 
         this.logger.info({ tokenUrl: creds.tokenUrl, clientId: creds.clientId }, 'Refreshing OAuth2 token');
 
         try {
-            const response = await axios.post(creds.tokenUrl, {
-                grant_type: 'refresh_token',
-                refresh_token: creds.refreshToken,
-                client_id: creds.clientId,
-                client_secret: creds.clientSecret,
+            const body = new URLSearchParams();
+            body.set('grant_type', 'refresh_token');
+            body.set('refresh_token', creds.refreshToken);
+            body.set('client_id', creds.clientId);
+            if (creds.clientSecret) {
+                body.set('client_secret', creds.clientSecret);
+            }
+
+            const response = await axios.post(creds.tokenUrl, body, {
+                headers: {
+                    'Content-Type': 'application/x-www-form-urlencoded',
+                    'Accept': 'application/json',
+                },
             });
 
             const { access_token, expires_in } = response.data;
+            const expiresInSeconds = Number(expires_in) || 3600;
 
             // Cache the token (don't mutate the input credentials)
             this.tokenCache.set(cacheKey, {
                 accessToken: access_token,
-                expiresAt: Date.now() + (expires_in * 1000),
+                expiresAt: Date.now() + (expiresInSeconds * 1000),
             });
 
             return `Bearer ${access_token}`;