@mhingston5/conduit 1.1.5 → 1.1.7

package/dist/index.js

@@ -29,6 +29,8 @@ var UpstreamCredentialsSchema = z.object({
   tokenUrl: z.string().optional(),
   refreshToken: z.string().optional(),
   scopes: z.array(z.string()).optional(),
+  tokenRequestFormat: z.enum(["form", "json"]).optional(),
+  tokenParams: z.record(z.string(), z.string()).optional(),
   apiKey: z.string().optional(),
   bearerToken: z.string().optional(),
   headerName: z.string().optional()
@@ -39,6 +41,18 @@ var HttpUpstreamSchema = z.object({
   url: z.string(),
   credentials: UpstreamCredentialsSchema.optional()
 });
+var StreamableHttpUpstreamSchema = z.object({
+  id: z.string(),
+  type: z.literal("streamableHttp"),
+  url: z.string(),
+  credentials: UpstreamCredentialsSchema.optional()
+});
+var SseUpstreamSchema = z.object({
+  id: z.string(),
+  type: z.literal("sse"),
+  url: z.string(),
+  credentials: UpstreamCredentialsSchema.optional()
+});
 var StdioUpstreamSchema = z.object({
   id: z.string(),
   type: z.literal("stdio"),
@@ -46,7 +60,12 @@ var StdioUpstreamSchema = z.object({
   args: z.array(z.string()).optional(),
   env: z.record(z.string(), z.string()).optional()
 });
-var UpstreamInfoSchema = z.union([HttpUpstreamSchema, StdioUpstreamSchema]);
+var UpstreamInfoSchema = z.union([
+  HttpUpstreamSchema,
+  StreamableHttpUpstreamSchema,
+  SseUpstreamSchema,
+  StdioUpstreamSchema
+]);
 var ConfigSchema = z.object({
   port: z.union([z.string(), z.number()]).default("3000").transform((v) => Number(v)),
   nodeEnv: z.enum(["development", "production", "test"]).default("development"),
@@ -111,9 +130,13 @@ var ConfigService = class {
   }
   loadConfigFile() {
     const configPath = process.env.CONFIG_FILE || (fs.existsSync(path.resolve(process.cwd(), "conduit.yaml")) ? "conduit.yaml" : fs.existsSync(path.resolve(process.cwd(), "conduit.json")) ? "conduit.json" : null);
-    if (!configPath) return {};
+    if (!configPath) {
+      console.warn(`[Conduit] No config file found in ${process.cwd()}. Running with default settings.`);
+      return {};
+    }
     try {
       const fullPath = path.resolve(process.cwd(), configPath);
+      console.error(`[Conduit] Loading config from ${fullPath}`);
       let fileContent = fs.readFileSync(fullPath, "utf-8");
       fileContent = fileContent.replace(/\$\{([a-zA-Z0-9_]+)(?::-([^}]+))?\}/g, (match, varName, defaultValue) => {
         const value = process.env[varName];
@@ -392,6 +415,7 @@ var StdioTransport = class {
   requestController;
   concurrencyService;
   buffer = "";
+  pendingRequests = /* @__PURE__ */ new Map();
   constructor(logger, requestController, concurrencyService) {
     this.logger = logger;
     this.requestController = requestController;
@@ -405,6 +429,30 @@ var StdioTransport = class {
       this.logger.info("Stdin closed");
     });
   }
+  async callHost(method, params) {
+    const id = Math.random().toString(36).substring(7);
+    const request = {
+      jsonrpc: "2.0",
+      id,
+      method,
+      params
+    };
+    return new Promise((resolve, reject) => {
+      const timeout = setTimeout(() => {
+        this.pendingRequests.delete(id);
+        reject(new Error(`Timeout waiting for host response to ${method}`));
+      }, 3e4);
+      this.pendingRequests.set(id, (response) => {
+        clearTimeout(timeout);
+        if (response.error) {
+          reject(new Error(response.error.message));
+        } else {
+          resolve(response.result);
+        }
+      });
+      this.sendResponse(request);
+    });
+  }
   handleData(chunk) {
     this.buffer += chunk;
     let pos;
@@ -416,11 +464,11 @@ var StdioTransport = class {
     }
   }
   async processLine(line) {
-    let request;
+    let message;
     try {
-      request = JSON.parse(line);
+      message = JSON.parse(line);
     } catch (err) {
-      this.logger.error({ err, line }, "Failed to parse JSON-RPC request");
+      this.logger.error({ err, line }, "Failed to parse JSON-RPC message");
       const errorResponse = {
         jsonrpc: "2.0",
         id: null,
@@ -432,6 +480,15 @@ var StdioTransport = class {
       this.sendResponse(errorResponse);
       return;
     }
+    if (message.id !== void 0 && (message.result !== void 0 || message.error !== void 0)) {
+      const pending = this.pendingRequests.get(message.id);
+      if (pending) {
+        this.pendingRequests.delete(message.id);
+        pending(message);
+        return;
+      }
+    }
+    const request = message;
     const context = new ExecutionContext({
       logger: this.logger,
       remoteAddress: "stdio"
@@ -775,12 +832,29 @@ var RequestController = class {
       case "notifications/initialized":
         return null;
       // Notifications don't get responses per MCP spec
+      case "mcp_register_upstream":
+        return this.handleRegisterUpstream(params, context, id);
       case "ping":
         return { jsonrpc: "2.0", id, result: {} };
       default:
         return this.errorResponse(id, -32601, `Method not found: ${method}`);
     }
   }
+  async handleRegisterUpstream(params, context, id) {
+    if (!params || !params.id || !params.type || !params.url && !params.command) {
+      return this.errorResponse(id, -32602, "Missing registration parameters (id, type, url/command)");
+    }
+    try {
+      this.gatewayService.registerUpstream(params);
+      return {
+        jsonrpc: "2.0",
+        id,
+        result: { success: true }
+      };
+    } catch (err) {
+      return this.errorResponse(id, -32001, err.message);
+    }
+  }
   async handleDiscoverTools(params, context, id) {
     const tools = await this.gatewayService.discoverTools(context);
     const standardizedTools = tools.map((t) => ({
@@ -848,13 +922,18 @@ var RequestController = class {
   async handleCallTool(params, context, id) {
     if (!params) return this.errorResponse(id, -32602, "Missing parameters");
     const { name, arguments: toolArgs } = params;
-    switch (name) {
-      case "mcp_execute_typescript":
-        return this.handleExecuteToolCall("typescript", toolArgs, context, id);
-      case "mcp_execute_python":
-        return this.handleExecuteToolCall("python", toolArgs, context, id);
-      case "mcp_execute_isolate":
-        return this.handleExecuteToolCall("isolate", toolArgs, context, id);
+    const toolId = this.gatewayService.policyService.parseToolName(name);
+    const baseName = toolId.name;
+    const isConduit = toolId.namespace === "conduit" || toolId.namespace === "";
+    if (isConduit) {
+      switch (baseName) {
+        case "mcp_execute_typescript":
+          return this.handleExecuteToolCall("typescript", toolArgs, context, id);
+        case "mcp_execute_python":
+          return this.handleExecuteToolCall("python", toolArgs, context, id);
+        case "mcp_execute_isolate":
+          return this.handleExecuteToolCall("isolate", toolArgs, context, id);
+      }
     }
     const response = await this.gatewayService.callTool(name, toolArgs, context);
     return { ...response, id };
@@ -1001,6 +1080,8 @@ var RequestController = class {
 import axios2 from "axios";
 import { Client } from "@modelcontextprotocol/sdk/client/index.js";
 import { StdioClientTransport } from "@modelcontextprotocol/sdk/client/stdio.js";
+import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
+import { SSEClientTransport } from "@modelcontextprotocol/sdk/client/sse.js";
 import { z as z2 } from "zod";
 var UpstreamClient = class {
   logger;
@@ -1009,6 +1090,7 @@ var UpstreamClient = class {
   urlValidator;
   mcpClient;
   transport;
+  connected = false;
   constructor(logger, info, authService, urlValidator) {
     this.logger = logger.child({ upstreamId: info.id });
     this.info = info;
@@ -1031,28 +1113,80 @@ var UpstreamClient = class {
       }, {
         capabilities: {}
       });
+      return;
     }
+    if (this.info.type === "streamableHttp") {
+      this.transport = new StreamableHTTPClientTransport(new URL(this.info.url), {
+        fetch: this.createAuthedFetch()
+      });
+      this.mcpClient = new Client({
+        name: "conduit-gateway",
+        version: "1.0.0"
+      }, {
+        capabilities: {}
+      });
+      return;
+    }
+    if (this.info.type === "sse") {
+      this.mcpClient = new Client({
+        name: "conduit-gateway",
+        version: "1.0.0"
+      }, {
+        capabilities: {}
+      });
+    }
+  }
+  createAuthedFetch() {
+    const creds = this.info.credentials;
+    if (!creds) return fetch;
+    return async (input, init = {}) => {
+      const headers = new Headers(init.headers || {});
+      const authHeaders = await this.authService.getAuthHeaders(creds);
+      for (const [k, v] of Object.entries(authHeaders)) {
+        headers.set(k, v);
+      }
+      return fetch(input, { ...init, headers });
+    };
   }
   async ensureConnected() {
-    if (!this.mcpClient || !this.transport) return;
-    try {
-      if (!this.transport.connection) {
-        await this.mcpClient.connect(this.transport);
+    if (!this.mcpClient) return;
+    if (!this.transport && this.info.type === "sse") {
+      const authHeaders = this.info.credentials ? await this.authService.getAuthHeaders(this.info.credentials) : {};
+      this.transport = new SSEClientTransport(new URL(this.info.url), {
+        fetch: this.createAuthedFetch(),
+        eventSourceInit: { headers: authHeaders },
+        requestInit: { headers: authHeaders }
+      });
+    }
+    if (!this.transport) return;
+    if (this.connected) return;
+    if (this.info.type === "streamableHttp" || this.info.type === "sse") {
+      const securityResult = await this.urlValidator.validateUrl(this.info.url);
+      if (!securityResult.valid) {
+        this.logger.error({ url: this.info.url }, "Blocked upstream URL (SSRF)");
+        throw new Error(securityResult.message || "Forbidden URL");
       }
+    }
+    try {
+      this.logger.debug("Connecting to upstream transport...");
+      await this.mcpClient.connect(this.transport);
+      this.connected = true;
+      this.logger.info("Connected to upstream MCP");
     } catch (e) {
+      this.logger.error({ err: e.message }, "Failed to connect to upstream");
+      throw e;
     }
   }
   async call(request, context) {
-    const isStdio = (info) => info.type === "stdio";
-    if (isStdio(this.info)) {
-      return this.callStdio(request);
-    } else {
-      return this.callHttp(request, context);
+    const usesMcpClientTransport = (info) => info.type === "stdio" || info.type === "streamableHttp" || info.type === "sse";
+    if (usesMcpClientTransport(this.info)) {
+      return this.callMcpClient(request);
     }
+    return this.callHttp(request, context);
   }
-  async callStdio(request) {
+  async callMcpClient(request) {
     if (!this.mcpClient) {
-      return { jsonrpc: "2.0", id: request.id, error: { code: -32603, message: "Stdio client not initialized" } };
+      return { jsonrpc: "2.0", id: request.id, error: { code: -32603, message: "MCP client not initialized" } };
     }
     try {
       await this.ensureConnected();
@@ -1092,19 +1226,21 @@ var UpstreamClient = class {
         };
       }
     } catch (error) {
-      this.logger.error({ err: error }, "Stdio call failed");
+      this.logger.error({ err: error }, "MCP call failed");
       return {
         jsonrpc: "2.0",
         id: request.id,
         error: {
           code: error.code || -32603,
-          message: error.message || "Internal error in stdio transport"
+          message: error.message || "Internal error in MCP transport"
         }
       };
     }
   }
   async callHttp(request, context) {
-    if (this.info.type === "stdio") throw new Error("Unreachable");
+    if (this.info.type === "stdio" || this.info.type === "streamableHttp" || this.info.type === "sse") {
+      throw new Error("Unreachable");
+    }
     const url = this.info.url;
     const headers = {
       "Content-Type": "application/json",
@@ -1153,7 +1289,7 @@ var UpstreamClient = class {
     }
   }
   async getManifest(context) {
-    if (this.info.type !== "http") return null;
+    if (this.info.type && this.info.type !== "http") return null;
     try {
       const baseUrl = this.info.url.replace(/\/$/, "");
       const manifestUrl = `${baseUrl}/conduit.manifest.json`;
@@ -1193,6 +1329,8 @@ var AuthService = class {
   logger;
   // Cache tokens separately from credentials to avoid mutation
   tokenCache = /* @__PURE__ */ new Map();
+  // Keep the latest refresh token in-memory (rotating tokens)
+  refreshTokenCache = /* @__PURE__ */ new Map();
   // Prevent concurrent refresh requests for the same client
   refreshLocks = /* @__PURE__ */ new Map();
   constructor(logger) {
@@ -1237,25 +1375,53 @@ var AuthService = class {
     }
     this.logger.info({ tokenUrl: creds.tokenUrl, clientId: creds.clientId }, "Refreshing OAuth2 token");
     try {
-      const body = new URLSearchParams();
-      body.set("grant_type", "refresh_token");
-      body.set("refresh_token", creds.refreshToken);
-      body.set("client_id", creds.clientId);
+      const tokenUrl = creds.tokenUrl;
+      const cachedRefreshToken = this.refreshTokenCache.get(cacheKey);
+      const refreshToken = cachedRefreshToken || creds.refreshToken;
+      if (!refreshToken) {
+        throw new Error("OAuth2 credentials missing required fields for refresh");
+      }
+      const payload = {
+        grant_type: "refresh_token",
+        refresh_token: refreshToken,
+        client_id: creds.clientId
+      };
       if (creds.clientSecret) {
-        body.set("client_secret", creds.clientSecret);
+        payload.client_secret = creds.clientSecret;
+      }
+      if (creds.tokenParams) {
+        Object.assign(payload, creds.tokenParams);
       }
-      const response = await axios3.post(creds.tokenUrl, body, {
+      const requestFormat = (() => {
+        if (creds.tokenRequestFormat) return creds.tokenRequestFormat;
+        try {
+          const hostname = new URL(tokenUrl).hostname;
+          if (hostname === "auth.atlassian.com") return "json";
+        } catch {
+        }
+        return "form";
+      })();
+      const response = requestFormat === "json" ? await axios3.post(tokenUrl, payload, {
+        headers: {
+          "Content-Type": "application/json",
+          "Accept": "application/json"
+        }
+      }) : await axios3.post(tokenUrl, new URLSearchParams(payload), {
         headers: {
           "Content-Type": "application/x-www-form-urlencoded",
           "Accept": "application/json"
         }
       });
-      const { access_token, expires_in } = response.data;
-      const expiresInSeconds = Number(expires_in) || 3600;
+      const { access_token, expires_in, refresh_token } = response.data;
+      const expiresInRaw = Number(expires_in);
+      const expiresInSeconds = Number.isFinite(expiresInRaw) ? expiresInRaw : 3600;
       this.tokenCache.set(cacheKey, {
         accessToken: access_token,
         expiresAt: Date.now() + expiresInSeconds * 1e3
       });
+      if (typeof refresh_token === "string" && refresh_token.length > 0) {
+        this.refreshTokenCache.set(cacheKey, refresh_token);
+      }
       return `Bearer ${access_token}`;
     } catch (err) {
       const errorMsg = err.response?.data?.error_description || err.response?.data?.error || err.message;
@@ -1346,6 +1512,9 @@ var PolicyService = class {
         }
         return true;
       }
+      if (patternParts.length === 1 && toolParts.length > 1) {
+        return patternParts[0] === toolParts[toolParts.length - 1];
+      }
       if (patternParts.length !== toolParts.length) return false;
       for (let i = 0; i < patternParts.length; i++) {
         if (patternParts[i] !== toolParts[i]) return false;
@@ -1428,7 +1597,8 @@ var GatewayService = class {
   // Cache compiled validators to avoid recompilation on every call
   validatorCache = /* @__PURE__ */ new Map();
   constructor(logger, urlValidator, policyService) {
-    this.logger = logger;
+    this.logger = logger.child({ component: "GatewayService" });
+    this.logger.debug("GatewayService instance created");
     this.urlValidator = urlValidator;
     this.authService = new AuthService(logger);
     this.schemaCache = new SchemaCache(logger);
@@ -1439,52 +1609,79 @@ var GatewayService = class {
   registerUpstream(info) {
     const client = new UpstreamClient(this.logger, info, this.authService, this.urlValidator);
     this.clients.set(info.id, client);
-    this.logger.info({ upstreamId: info.id }, "Registered upstream MCP");
+    this.logger.info({ upstreamId: info.id, totalRegistered: this.clients.size }, "Registered upstream MCP");
+  }
+  registerHost(transport) {
+    this.logger.debug("Host transport available but not registered as tool upstream (protocol limitation)");
   }
   async listToolPackages() {
-    return Array.from(this.clients.entries()).map(([id, client]) => ({
+    const upstreams = Array.from(this.clients.entries()).map(([id, client]) => ({
       id,
       description: `Upstream ${id}`,
-      // NOTE: Upstream description fetching deferred to V2
       version: "1.0.0"
     }));
+    return [
+      { id: "conduit", description: "Conduit built-in execution tools", version: "1.0.0" },
+      ...upstreams
+    ];
+  }
+  getBuiltInTools() {
+    return BUILT_IN_TOOLS;
   }
   async listToolStubs(packageId, context) {
+    if (packageId === "conduit") {
+      const stubs2 = BUILT_IN_TOOLS.map((t) => ({
+        id: `conduit__${t.name}`,
+        name: t.name,
+        description: t.description
+      }));
+      if (context.allowedTools) {
+        return stubs2.filter((t) => this.policyService.isToolAllowed(t.id, context.allowedTools));
+      }
+      return stubs2;
+    }
     const client = this.clients.get(packageId);
     if (!client) {
       throw new Error(`Upstream package not found: ${packageId}`);
     }
     let tools = this.schemaCache.get(packageId);
     if (!tools) {
-      try {
-        const manifest = await client.getManifest(context);
-        if (manifest) {
-          const stubs2 = manifest.tools.map((t) => ({
-            id: `${packageId}__${t.name}`,
-            name: t.name,
-            description: t.description
-          }));
-          if (context.allowedTools) {
-            return stubs2.filter((t) => this.policyService.isToolAllowed(t.id, context.allowedTools));
+      if (typeof client.getManifest === "function") {
+        try {
+          const manifest = await client.getManifest(context);
+          if (manifest && manifest.tools) {
+            tools = manifest.tools;
           }
-          return stubs2;
+        } catch (e) {
+          this.logger.debug({ upstreamId: packageId, err: e.message }, "Manifest fetch failed (will fallback)");
         }
-      } catch (e) {
-        this.logger.debug({ packageId, err: e }, "Manifest fetch failed, falling back to RPC");
       }
-      const response = await client.call({
-        jsonrpc: "2.0",
-        id: "discovery",
-        method: "tools/list"
-      }, context);
-      if (response.result?.tools) {
-        tools = response.result.tools;
+      if (!tools) {
+        try {
+          if (typeof client.listTools === "function") {
+            tools = await client.listTools();
+          } else {
+            const response = await client.call({
+              jsonrpc: "2.0",
+              id: "discovery",
+              method: "tools/list"
+            }, context);
+            if (response.result?.tools) {
+              tools = response.result.tools;
+            } else {
+              this.logger.warn({ upstreamId: packageId, error: response.error }, "Failed to discover tools via RPC");
+            }
+          }
+        } catch (e) {
+          this.logger.error({ upstreamId: packageId, err: e.message }, "Error during tool discovery");
+        }
+      }
+      if (tools && tools.length > 0) {
         this.schemaCache.set(packageId, tools);
-      } else {
-        this.logger.warn({ upstreamId: packageId, error: response.error }, "Failed to discover tools from upstream");
-        tools = [];
+        this.logger.info({ upstreamId: packageId, toolCount: tools.length }, "Discovered tools from upstream");
       }
     }
+    if (!tools) tools = [];
     const stubs = tools.map((t) => ({
       id: `${packageId}__${t.name}`,
       name: t.name,
@@ -1500,10 +1697,22 @@ var GatewayService = class {
       throw new Error(`Access to tool ${toolId} is forbidden by allowlist`);
     }
     const parsed = this.policyService.parseToolName(toolId);
+    const namespace = parsed.namespace;
     const toolName = parsed.name;
-    const builtIn = BUILT_IN_TOOLS.find((t) => t.name === toolId);
-    if (builtIn) return builtIn;
-    const upstreamId = parsed.namespace;
+    if (namespace === "conduit" || namespace === "") {
+      const builtIn = BUILT_IN_TOOLS.find((t) => t.name === toolName);
+      if (builtIn) {
+        return { ...builtIn, name: `conduit__${builtIn.name}` };
+      }
+    }
+    const upstreamId = namespace;
+    if (!upstreamId) {
+      for (const id of this.clients.keys()) {
+        const schema = await this.getToolSchema(`${id}__${toolName}`, context);
+        if (schema) return schema;
+      }
+      return null;
+    }
     if (!this.schemaCache.get(upstreamId)) {
       await this.listToolStubs(upstreamId, context);
     }
@@ -1516,34 +1725,37 @@ var GatewayService = class {
     };
   }
   async discoverTools(context) {
-    const allTools = [...BUILT_IN_TOOLS];
+    const allTools = BUILT_IN_TOOLS.map((t) => ({
+      ...t,
+      name: `conduit__${t.name}`
+    }));
+    this.logger.debug({ clientCount: this.clients.size, clientIds: Array.from(this.clients.keys()) }, "Starting tool discovery");
     for (const [id, client] of this.clients.entries()) {
-      let tools = this.schemaCache.get(id);
-      if (!tools) {
-        const response = await client.call({
-          jsonrpc: "2.0",
-          id: "discovery",
-          method: "tools/list"
-          // Standard MCP method
-        }, context);
-        if (response.result?.tools) {
-          tools = response.result.tools;
-          this.schemaCache.set(id, tools);
+      if (id === "host") {
+        continue;
+      }
+      this.logger.debug({ upstreamId: id }, "Discovering tools from upstream");
+      try {
+        await this.listToolStubs(id, context);
+      } catch (e) {
+        this.logger.error({ upstreamId: id, err: e.message }, "Failed to list tool stubs");
+      }
+      const tools = this.schemaCache.get(id) || [];
+      this.logger.debug({ upstreamId: id, toolCount: tools.length }, "Discovery result");
+      if (tools && tools.length > 0) {
+        const prefixedTools = tools.map((t) => ({ ...t, name: `${id}__${t.name}` }));
+        if (context.allowedTools) {
+          allTools.push(...prefixedTools.filter((t) => this.policyService.isToolAllowed(t.name, context.allowedTools)));
         } else {
-          this.logger.warn({ upstreamId: id, error: response.error }, "Failed to discover tools from upstream");
-          tools = [];
+          allTools.push(...prefixedTools);
         }
       }
-      const prefixedTools = tools.map((t) => ({ ...t, name: `${id}__${t.name}` }));
-      if (context.allowedTools) {
-        allTools.push(...prefixedTools.filter((t) => this.policyService.isToolAllowed(t.name, context.allowedTools)));
-      } else {
-        allTools.push(...prefixedTools);
-      }
     }
+    this.logger.info({ totalTools: allTools.length }, "Tool discovery complete");
     return allTools;
   }
   async callTool(name, params, context) {
+    this.logger.debug({ name, upstreamCount: this.clients.size }, "GatewayService.callTool called");
     if (context.allowedTools && !this.policyService.isToolAllowed(name, context.allowedTools)) {
       this.logger.warn({ name, allowedTools: context.allowedTools }, "Tool call blocked by allowlist");
       return {
@@ -1558,14 +1770,37 @@ var GatewayService = class {
     const toolId = this.policyService.parseToolName(name);
     const upstreamId = toolId.namespace;
     const toolName = toolId.name;
+    this.logger.debug({ name, upstreamId, toolName }, "Parsed tool name");
+    if (!upstreamId) {
+      this.logger.debug({ toolName }, "Namespaceless call, attempting discovery across upstreams");
+      const allStubs = await this.discoverTools(context);
+      const found = allStubs.find((t) => {
+        const parts = t.name.split("__");
+        return parts[parts.length - 1] === toolName;
+      });
+      if (found) {
+        this.logger.debug({ original: name, resolved: found.name }, "Resolved namespaceless tool");
+        return this.callTool(found.name, params, context);
+      }
+      const upstreamList = Array.from(this.clients.keys()).filter((k) => k !== "host");
+      return {
+        jsonrpc: "2.0",
+        id: 0,
+        error: {
+          code: -32601,
+          message: `Tool '${toolName}' not found. Discovered ${allStubs.length} tools from upstreams: [${upstreamList.join(", ") || "none"}]. Available tools: ${allStubs.map((t) => t.name).slice(0, 10).join(", ")}${allStubs.length > 10 ? "..." : ""}`
+        }
+      };
+    }
     const client = this.clients.get(upstreamId);
     if (!client) {
+      this.logger.error({ upstreamId, availableUpstreams: Array.from(this.clients.keys()) }, "Upstream not found");
       return {
         jsonrpc: "2.0",
         id: 0,
         error: {
           code: -32003,
-          message: `Upstream not found: ${upstreamId}`
+          message: `Upstream not found: '${upstreamId}'. Available: ${Array.from(this.clients.keys()).join(", ") || "none"}`
         }
       };
     }
@@ -2719,7 +2954,8 @@ var SDKGenerator = class {
    * Convert camelCase to snake_case for Python
    */
   toSnakeCase(str) {
-    return str.replace(/([A-Z])/g, "_$1").toLowerCase().replace(/^_/, "");
+    const snake = str.replace(/([A-Z])/g, "_$1").toLowerCase().replace(/^_/, "").replace(/[^a-z0-9_]/g, "_");
+    return /^[0-9]/.test(snake) ? `_${snake}` : snake;
   }
   /**
    * Escape a string for use in generated code
@@ -2788,7 +3024,18 @@ const tools = new Proxy(_tools, {
         if (prop in target) return target[prop];
         if (prop === 'then') return undefined;
         if (typeof prop === 'string') {
-            throw new Error(\`Namespace '\${prop}' not found. It might be invalid, or all tools in it were disallowed.\`);
+            // Flat tool access fallback: search all namespaces for a matching tool
+            for (const nsName of Object.keys(target)) {
+                if (nsName === '$raw') continue;
+                const ns = target[nsName];
+                if (ns && typeof ns === 'object' && ns[prop]) {
+                    return ns[prop];
+                }
+            }
+
+            const forbidden = ['$raw'];
+            const namespaces = Object.keys(target).filter(k => !forbidden.includes(k));
+            throw new Error(\`Namespace or Tool '\${prop}' not found. Available namespaces: \${namespaces.join(', ') || 'none'}. Use tools.$raw(name, args) for dynamic calls.\`);
         }
         return undefined;
     }
@@ -2815,28 +3062,39 @@ const tools = new Proxy(_tools, {
       lines.push("_allowed_tools = None");
     }
     lines.push("");
-    lines.push("class _ToolNamespace:");
-    lines.push("    def __init__(self, methods):");
-    lines.push("        for name, fn in methods.items():");
-    lines.push("            setattr(self, name, fn)");
-    lines.push("");
-    lines.push("class _Tools:");
-    lines.push("    def __init__(self):");
     for (const [namespace, tools] of grouped.entries()) {
       const safeNamespace = this.toSnakeCase(namespace);
-      const methodsDict = [];
+      lines.push(`class _${safeNamespace}_Namespace:`);
       for (const tool of tools) {
         const methodName = this.toSnakeCase(tool.methodName);
         const fullName = tool.name;
-        methodsDict.push(`            "${methodName}": lambda args, n="${this.escapeString(fullName)}": _internal_call_tool(n, args)`);
+        lines.push(`    async def ${methodName}(self, args=None, **kwargs):`);
+        lines.push(`        params = args if args is not None else kwargs`);
+        lines.push(`        return await _internal_call_tool("${this.escapeString(fullName)}", params)`);
       }
-      lines.push(`        self.${safeNamespace} = _ToolNamespace({`);
-      lines.push(methodsDict.join(",\n"));
-      lines.push(`        })`);
+      lines.push("");
     }
+    lines.push("class _Tools:");
+    lines.push("    def __init__(self):");
+    if (grouped.size === 0) {
+      lines.push("        pass");
+    } else {
+      for (const [namespace] of grouped.entries()) {
+        const safeNamespace = this.toSnakeCase(namespace);
+        lines.push(`        self.${safeNamespace} = _${safeNamespace}_Namespace()`);
+      }
+    }
+    lines.push("");
+    lines.push("    def __getattr__(self, name):");
+    lines.push("        # Flat access fallback: search all namespaces");
+    lines.push("        for attr_name in dir(self):");
+    lines.push("            attr = getattr(self, attr_name, None)");
+    lines.push("            if attr and hasattr(attr, name):");
+    lines.push("                return getattr(attr, name)");
+    lines.push(`        raise AttributeError(f"Namespace or Tool '{name}' not found")`);
     if (enableRawFallback) {
       lines.push("");
-      lines.push("    async def raw(self, name, args):");
+      lines.push("    async def raw(self, name, args=None):");
       lines.push('        """Call a tool by its full name (escape hatch for dynamic/unknown tools)"""');
       lines.push('        normalized = name.replace(".", "__")');
       lines.push("        if _allowed_tools is not None:");
@@ -2846,7 +3104,7 @@ const tools = new Proxy(_tools, {
       lines.push("            )");
       lines.push("            if not allowed:");
       lines.push('                raise PermissionError(f"Tool {name} is not in the allowlist")');
-      lines.push("        return await _internal_call_tool(normalized, args)");
+      lines.push("        return await _internal_call_tool(normalized, args or {})");
     }
     lines.push("");
     lines.push("tools = _Tools()");
@@ -2888,21 +3146,21 @@ const tools = new Proxy(_tools, {
         lines.push(`      return JSON.parse(resStr);`);
         lines.push(`    },`);
       }
-      lines.push(`  },`);
+      lines.push("  },");
     }
     if (enableRawFallback) {
-      lines.push(`  async $raw(name, args) {`);
+      lines.push("  async $raw(name, args) {");
       lines.push(`    const normalized = name.replace(/\\./g, '__');`);
-      lines.push(`    if (__allowedTools) {`);
+      lines.push("    if (__allowedTools) {");
       lines.push(`      const allowed = __allowedTools.some(p => {`);
       lines.push(`        if (p.endsWith('__*')) return normalized.startsWith(p.slice(0, -1));`);
-      lines.push(`        return normalized === p;`);
-      lines.push(`      });`);
-      lines.push(`      if (!allowed) throw new Error(\`Tool \${name} is not in the allowlist\`);`);
-      lines.push(`    }`);
-      lines.push(`    const resStr = await __callTool(normalized, JSON.stringify(args || {}));`);
-      lines.push(`    return JSON.parse(resStr);`);
-      lines.push(`  },`);
+      lines.push("        return normalized === p;");
+      lines.push("      });");
+      lines.push("      if (!allowed) throw new Error(`Tool ${name} is not in the allowlist`);");
+      lines.push("    }");
+      lines.push("    const resStr = await __callTool(normalized, JSON.stringify(args || {}));");
+      lines.push("    return JSON.parse(resStr);");
+      lines.push("  },");
     }
     lines.push("};");
     lines.push(`
@@ -2911,7 +3169,18 @@ const tools = new Proxy(_tools, {
         if (prop in target) return target[prop];
         if (prop === 'then') return undefined;
         if (typeof prop === 'string') {
-            throw new Error(\`Namespace '\${prop}' not found. It might be invalid, or all tools in it were disallowed.\`);
+            // Flat tool access fallback: search all namespaces for a matching tool
+            for (const nsName of Object.keys(target)) {
+                if (nsName === '$raw') continue;
+                const ns = target[nsName];
+                if (ns && typeof ns === 'object' && ns[prop]) {
+                    return ns[prop];
+                }
+            }
+
+            const forbidden = ['$raw'];
+            const namespaces = Object.keys(target).filter(k => !forbidden.includes(k));
+            throw new Error(\`Namespace or Tool '\${prop}' not found. Available namespaces: \${namespaces.join(', ') || 'none'}. Use tools.$raw(name, args) for dynamic calls.\`);
         }
         return undefined;
     }
@@ -3006,14 +3275,17 @@ var ExecutionService = class {
   async getToolBindings(context) {
     const packages = await this.gatewayService.listToolPackages();
     const allBindings = [];
+    this.logger.debug({ packageCount: packages.length, packages: packages.map((p) => p.id) }, "Fetching tool bindings");
     for (const pkg of packages) {
       try {
         const stubs = await this.gatewayService.listToolStubs(pkg.id, context);
+        this.logger.debug({ packageId: pkg.id, stubCount: stubs.length }, "Got stubs from package");
         allBindings.push(...stubs.map((s) => toToolBinding(s.id, void 0, s.description)));
       } catch (err) {
         this.logger.warn({ packageId: pkg.id, err: err.message }, "Failed to list stubs for package");
       }
     }
+    this.logger.info({ totalBindings: allBindings.length }, "Tool bindings ready for SDK generation");
     return allBindings;
   }
   async executeIsolate(code, limits, context, allowedTools) {
@@ -3282,21 +3554,29 @@ async function handleAuth(options) {
         return;
       }
       try {
-        const body = new URLSearchParams();
-        body.set("grant_type", "authorization_code");
-        body.set("code", code);
-        body.set("redirect_uri", redirectUri);
-        body.set("client_id", options.clientId);
+        const payload = {
+          grant_type: "authorization_code",
+          code,
+          redirect_uri: redirectUri,
+          client_id: options.clientId
+        };
         if (options.clientSecret) {
-          body.set("client_secret", options.clientSecret);
+          payload.client_secret = options.clientSecret;
         }
         if (codeVerifier) {
-          body.set("code_verifier", codeVerifier);
+          payload.code_verifier = codeVerifier;
         }
         if (resolvedResource) {
-          body.set("resource", resolvedResource);
+          payload.resource = resolvedResource;
         }
-        const response = await axios4.post(resolvedTokenUrl, body, {
+        const tokenHostname = new URL(resolvedTokenUrl).hostname;
+        const useJson = tokenHostname === "auth.atlassian.com";
+        const response = useJson ? await axios4.post(resolvedTokenUrl, payload, {
+          headers: {
+            "Content-Type": "application/json",
+            "Accept": "application/json"
+          }
+        }) : await axios4.post(resolvedTokenUrl, new URLSearchParams(payload), {
           headers: {
             "Content-Type": "application/x-www-form-urlencoded",
             "Accept": "application/json"
@@ -3360,9 +3640,9 @@ async function handleAuth(options) {
 // src/index.ts
 var program = new Command();
 program.name("conduit").description("A secure Code Mode execution substrate for MCP agents").version("1.0.0");
-program.command("serve", { isDefault: true }).description("Start the Conduit server").option("--stdio", "Use stdio transport").action(async (options) => {
+program.command("serve", { isDefault: true }).description("Start the Conduit server").option("--stdio", "Use stdio transport").option("--config <path>", "Path to config file").action(async (options) => {
   try {
-    await startServer();
+    await startServer(options);
   } catch (err) {
     console.error("Failed to start Conduit:", err);
     process.exit(1);
@@ -3386,8 +3666,11 @@ program.command("auth").description("Help set up OAuth for an upstream MCP serve
     process.exit(1);
   }
 });
-async function startServer() {
-  const configService = new ConfigService();
+async function startServer(options = {}) {
+  const overrides = {};
+  if (options.stdio) overrides.transport = "stdio";
+  if (options.config) process.env.CONFIG_FILE = options.config;
+  const configService = new ConfigService(overrides);
   const logger = createLogger(configService);
   const otelService = new OtelService(logger);
   await otelService.start();
@@ -3397,6 +3680,7 @@ async function startServer() {
     const securityService = new SecurityService(logger, ipcToken);
     const gatewayService = new GatewayService(logger, securityService);
     const upstreams = configService.get("upstreams") || [];
+    logger.info({ upstreamCount: upstreams.length, upstreamIds: upstreams.map((u) => u.id) }, "Registering upstreams from config");
     for (const upstream of upstreams) {
       gatewayService.registerUpstream(upstream);
     }
@@ -3426,8 +3710,10 @@ async function startServer() {
     let transport;
     let address;
     if (configService.get("transport") === "stdio") {
-      transport = new StdioTransport(logger, requestController, concurrencyService);
+      const stdioTransport = new StdioTransport(logger, requestController, concurrencyService);
+      transport = stdioTransport;
       await transport.start();
+      gatewayService.registerHost(stdioTransport);
       address = "stdio";
       const internalTransport = new SocketTransport(logger, requestController, concurrencyService);
       const internalPort = 0;