@myagentroam/node 0.10.40 → 0.10.41

package/dist/claude-agent-sdk.js

@@ -1,3 +1,4 @@
+import { NODE_MCP, NODE_MCP_VERSION } from './mcp/naming.js';
 import { spawnSync } from 'node:child_process';
 import { createSdkMcpServer, forkSession, getSessionInfo, getSessionMessages, listSessions, query } from '@anthropic-ai/claude-agent-sdk';
 import { tool } from '@anthropic-ai/claude-agent-sdk';
@@ -44,6 +45,8 @@ export class ClaudeAgentSdkAdapter {
         };
     }
     startWithPrompt(input, prompt, channelEnabled = false) {
+        if (channelEnabled && Object.hasOwn(input.mcpServers ?? {}, NODE_MCP.channel.name))
+            throw Object.assign(new Error('MCP_SERVER_NAME_CONFLICT: A user MCP conflicts with the managed Channel.'), { code: 'MCP_SERVER_NAME_CONFLICT' });
         const abortController = new AbortController();
         const stream = this.sdk.query({
             prompt,
@@ -80,7 +83,7 @@ export class ClaudeAgentSdkAdapter {
                     ? {
                         mcpServers: {
                             ...(input.mcpServers ?? {}),
-                            ...(channelEnabled ? { myagentroam: channelMcpServer(input) } : {})
+                            ...(channelEnabled ? { [NODE_MCP.channel.name]: channelMcpServer(input) } : {})
                         }
                     }
                     : {})
@@ -172,12 +175,12 @@ function claudePermissionMode(access) {
 }
 function channelMcpServer(input) {
     return createSdkMcpServer({
-        name: 'myagentroam',
-        version: '0.1.4',
-        instructions: 'Use the myagentroam_channel_reply tool only to send a concise reply to the Admin Channel.',
+        name: NODE_MCP.channel.name,
+        version: NODE_MCP_VERSION,
+        instructions: 'Use the reply tool from the mar_channel MCP server only to send a concise reply to the Admin Channel.',
         alwaysLoad: true,
         tools: [
-            tool('channel_reply', 'Send one text reply to the authorized MyAgentRoam Admin Channel.', { content: z.string().min(1).max(20_000) }, async ({ content }) => {
+            tool(NODE_MCP.channel.tools.reply, 'Send one text reply to the authorized MyAgentRoam Admin Channel.', { content: z.string().min(1).max(20_000) }, async ({ content }) => {
                 input.onChannelReply?.(content);
                 return { content: [{ type: 'text', text: 'Channel reply delivered.' }] };
             }, { alwaysLoad: true })

package/dist/connector.js

@@ -12,7 +12,8 @@ import { TerminalManager } from './terminal.js';
 import { NodeRuntimeState } from './runtime-state.js';
 import { CommandStateStore } from './runner-command-engine.js';
 import { goalUnrestrictedAccess, GoalRuntime } from './service/goal-runtime.js';
-import { GoalMcpServer } from './service/goal-mcp-server.js';
+import { GoalMcpBridge } from './service/goal-mcp-bridge.js';
+import { NODE_MCP } from './mcp/naming.js';
 import { RunnerUsageReader } from './runner-usage.js';
 import { ClaudeCodeRunner } from './runner/claude-code-runner.js';
 import { ClaudeManagedRunController } from './runner/claude/managed-run-controller.js';
@@ -71,9 +72,9 @@ import { ScheduledSessionStore } from './service/scheduled-session-store.js';
 import { RunAuthorizationControl } from './service/run-authorization-control.js';
 import { PlannedRestartHandoff } from './service/planned-restart-handoff.js';
 import { RestartSessionRestorer } from './service/restart-session-restorer.js';
-import { ScheduledTaskMcpServer } from './service/scheduled-task-mcp-server.js';
+import { ScheduleMcpBridge } from './service/schedule-mcp-bridge.js';
 import { MailNotificationControl } from './service/mail-notification-control.js';
-import { MailNotificationMcpServer, resolveMailNotificationCapability } from './service/mail-notification-mcp-server.js';
+import { NotificationMcpBridge, resolveNotificationCapability } from './service/notification-mcp-bridge.js';
 import { SessionCatalogService } from './service/session-catalog-service.js';
 import { SessionCommandService } from './service/session-command-service.js';
 import { SessionPresentationService } from './service/session-presentation-service.js';
@@ -287,7 +288,7 @@ export class NodeConnector {
     goalExecutionProgress = new Set();
     nativeGoalBindings = new Map();
     sessionScheduleService;
-    goalMcpServer = new GoalMcpServer(this.goalRuntime, (sessionId) => {
+    goalMcpBridge = new GoalMcpBridge(this.goalRuntime, (sessionId) => {
         const goal = this.goalRuntime.get(sessionId);
         const session = this.runtime.getAgentSession(sessionId);
         if (goal === undefined || session === undefined)
@@ -299,7 +300,7 @@ export class NodeConnector {
         }
         this.publishGoalState(session, goal);
     });
-    scheduledTaskMcpServer = new ScheduledTaskMcpServer(() => {
+    scheduleMcpBridge = new ScheduleMcpBridge(() => {
         if (this.database === undefined)
             throw new Error('NODE_DATABASE_UNAVAILABLE');
         return new ScheduledSessionStore(this.database.raw);
@@ -315,7 +316,7 @@ export class NodeConnector {
             throw new Error('SCHEDULE_SERVICE_UNAVAILABLE');
         return this.sessionScheduleService.createFromMcp(input);
     }, (sessionId) => this.runtime.getAgentSession(sessionId)?.externalSessionId ?? sessionId);
-    mailNotificationMcpServer = new MailNotificationMcpServer((capability) => resolveMailNotificationCapability(this.runtime, capability), (request) => this.mailNotificationControl.request(request), {
+    notificationMcpBridge = new NotificationMcpBridge((capability) => resolveNotificationCapability(this.runtime, capability), (request) => this.mailNotificationControl.request(request), {
         supported: () => this.mailNotificationControl.supportsChannels(),
         send: (request) => this.mailNotificationControl.notification(request)
     });
@@ -326,7 +327,7 @@ export class NodeConnector {
     workspaceWatchService = new WorkspaceWatchService(this.workspaceState, (workspaceId) => this.workspaceSessionService.ensureWatch(workspaceId), (workspaceId) => this.workspaceSessionService.stopWatch(workspaceId), (workspaceId) => this.workspaceWorkbenchService?.releaseWorkspace(workspaceId), (watch) => this.workspaceWorkbenchService?.cancelFilePrewarm(watch));
     workspaceSessionService = new WorkspaceSessionService(this.workspaceState, {
         discover: (workspaceId, onRunnerDiscovered) => this.discoverWorkspaceSessions(workspaceId, onRunnerDiscovered),
-        listPage: (workspaceId) => this.executeNodeOperation('session.list', { workspaceId, limit: 20 }),
+        listPage: (workspaceId) => this.executeNodeOperation('session.list', { workspaceId, limit: 30 }),
         active: (workspaceId) => this.workspaceWatchService.topicActive(workspaceId, 'sessions'),
         invalidate: (workspaceId) => void this.workspaceWorkbenchService?.invalidateTopic(workspaceId, 'sessions')
     });
@@ -469,12 +470,15 @@ export class NodeConnector {
         releaseExecution: (executionId) => {
             this.modelUsage.release(executionId);
             this.goalExecutionProgress.delete(executionId);
-            this.goalMcpServer.revoke(executionId);
-            this.scheduledTaskMcpServer.revoke(executionId);
-            this.mailNotificationMcpServer.revoke(executionId);
+            this.revokeExecutionMcps(executionId);
             this.continuousRunCoordinator.remove(executionId);
         }
     });
+    revokeExecutionMcps(executionId) {
+        this.goalMcpBridge.revoke(executionId);
+        this.scheduleMcpBridge.revoke(executionId);
+        this.notificationMcpBridge.revoke(executionId);
+    }
     sessionWatchSlots = new SessionWatchSlotCoordinator();
     nativeSessionWatchService = new NativeSessionWatchService({
         resolve: async (sessionId) => this.runtime.getAgentSession(sessionId) ??
@@ -856,40 +860,25 @@ export class NodeConnector {
                     code: safeErrorCode(error, 'GOAL_EXECUTION_START_FAILED')
                 });
             },
+            revokeExecutionMcps: (executionId) => this.revokeExecutionMcps(executionId),
             goalMcp: async (input) => {
                 if (input.goal === undefined)
                     throw new Error('GOAL_NOT_ACTIVE');
-                const resolved = await this.goalMcpServer.installation({
+                return this.goalMcpBridge.prepare({
                     executionId: input.runId,
                     sessionId: input.sessionId,
                     goalId: input.goal.id,
                     revision: input.goal.revision
                 });
-                return {
-                    installation: {
-                        targetKind: 'WORKSPACE',
-                        targetId: input.workspaceId,
-                        catalogEntryId: 'mar-internal-goal',
-                        serverName: 'myagentroam_goal',
-                        displayName: 'Goal',
-                        version: '1.0.0',
-                        enabled: true,
-                        runtime: { transport: 'HTTP', url: 'https://127.0.0.1.invalid/mcp', headers: {} },
-                        configuration: resolved.installation,
-                        installedAt: Date.now(),
-                        ...resolved.installation
-                    },
-                    secrets: resolved.secrets
-                };
             },
-            scheduledMcp: async (input) => {
+            scheduleMcp: async (input) => {
                 if (this.database === undefined)
                     return undefined;
                 const task = new ScheduledSessionStore(this.database.raw).get(input.sessionId);
                 const run = this.runtime.getRun(input.runId);
                 if (run?.initiatedByUserId === undefined)
                     return undefined;
-                const resolved = await this.scheduledTaskMcpServer.installation({
+                return this.scheduleMcpBridge.prepare({
                     executionId: input.runId,
                     sessionId: input.sessionId,
                     workspaceId: input.workspaceId,
@@ -897,50 +886,18 @@ export class NodeConnector {
                     actorUserId: run.initiatedByUserId,
                     readonly: run.source === 'SCHEDULED'
                 });
-                return {
-                    installation: {
-                        targetKind: 'WORKSPACE',
-                        targetId: input.workspaceId,
-                        catalogEntryId: 'mar-internal-schedule',
-                        serverName: 'mar_schedule',
-                        displayName: 'MAR scheduled task',
-                        version: '1.0.0',
-                        enabled: true,
-                        runtime: { transport: 'HTTP', url: 'https://127.0.0.1.invalid/mcp', headers: {} },
-                        configuration: resolved.installation,
-                        installedAt: Date.now(),
-                        ...resolved.installation
-                    },
-                    secrets: resolved.secrets
-                };
             },
-            mailMcp: async (input) => {
+            notificationMcp: async (input) => {
                 const run = this.runtime.getRun(input.runId);
                 if (run?.initiatedByUserId === undefined)
                     return undefined;
-                const resolved = await this.mailNotificationMcpServer.installation({
+                return this.notificationMcpBridge.prepare({
                     executionId: input.runId,
                     sessionId: input.sessionId,
                     workspaceId: input.workspaceId,
                     userId: run.initiatedByUserId,
                     source: run.source === 'SCHEDULED' ? 'SCHEDULED' : 'MANUAL'
                 });
-                return {
-                    installation: {
-                        targetKind: 'WORKSPACE',
-                        targetId: input.workspaceId,
-                        catalogEntryId: 'mar-internal-mail',
-                        serverName: 'mar_notification',
-                        displayName: 'MAR notification',
-                        version: '1.0.0',
-                        enabled: true,
-                        runtime: { transport: 'HTTP', url: 'https://127.0.0.1.invalid/mcp', headers: {} },
-                        configuration: resolved.installation,
-                        installedAt: Date.now(),
-                        ...resolved.installation
-                    },
-                    secrets: resolved.secrets
-                };
             }
         });
         this.workspaceQueueWorkbenchService = new WorkspaceQueueWorkbenchService({
@@ -974,7 +931,7 @@ export class NodeConnector {
             migrateGoal: (previousId, nextId) => {
                 this.runAttachmentService.migrateSession(previousId, nextId);
                 this.goalRuntime.migrateSession(previousId, nextId);
-                this.goalMcpServer.migrateSession(previousId, nextId);
+                this.goalMcpBridge.migrateSession(previousId, nextId);
                 const retry = this.goalRetryTimers.get(previousId);
                 if (retry !== undefined) {
                     this.goalRetryTimers.delete(previousId);
@@ -1368,7 +1325,7 @@ export class NodeConnector {
                 this.scheduledRunAuthorization.disconnected();
                 this.restartAuthorization.disconnected();
                 this.mailNotificationControl.disconnected();
-                this.mailNotificationMcpServer.revokeAll();
+                this.notificationMcpBridge.revokeAll();
                 this.terminalChannel.disconnect();
                 if (code === 4000 && reason === 'NODE_CONNECTION_REPLACED')
                     nodeLog('node.connection.replaced', {
@@ -1562,7 +1519,7 @@ export class NodeConnector {
             files: this.workspaceFileService,
             uploads: this.workspaceUploadService,
             changes: this.workspaceChangeService,
-            listSessions: (workspaceId) => this.executeNodeOperation('session.list', { workspaceId, limit: 20 }),
+            listSessions: (workspaceId) => this.executeNodeOperation('session.list', { workspaceId, limit: 30 }),
             invalidate: (workspaceId) => {
                 this.workspaceFileService.dispose(workspaceId);
                 this.workspaceWorkbenchService.invalidateWorkspaceFiles(workspaceId);
@@ -2267,8 +2224,8 @@ export class NodeConnector {
         this.workspaceSessionService.clear();
         this.workspaceChangeService.clear();
         const runnerDrain = this.runners.stop();
-        const goalMcpDrain = this.goalMcpServer.close();
-        const scheduledMcpDrain = this.scheduledTaskMcpServer.close();
+        const goalMcpDrain = this.goalMcpBridge.close();
+        const scheduleMcpDrain = this.scheduleMcpBridge.close();
         // close() transitions metadata before awaiting process-tree termination,
         // so the lifecycle is persisted before this synchronous shutdown returns.
         const terminalDrain = this.terminalManager.shutdown();
@@ -2279,7 +2236,7 @@ export class NodeConnector {
         this.scheduledRunAuthorization.close();
         this.restartAuthorization.close();
         this.mailNotificationControl.close();
-        const mailMcpDrain = this.mailNotificationMcpServer.close();
+        const notificationMcpDrain = this.notificationMcpBridge.close();
         const webToolDrain = this.webToolService.close();
         this.directTransferService?.dispose();
         this.directTransferService = undefined;
@@ -2292,8 +2249,8 @@ export class NodeConnector {
             terminalDrain,
             uploadDrain,
             goalMcpDrain,
-            scheduledMcpDrain,
-            mailMcpDrain,
+            scheduleMcpDrain,
+            notificationMcpDrain,
             webToolDrain
         ]);
         return (async () => {
@@ -2521,6 +2478,11 @@ export class NodeConnector {
         this.controlChannel.sendEnvelope(envelope);
     }
 }
+const goalReadToolNames = new Set([
+    `${NODE_MCP.goal.name}.${NODE_MCP.goal.tools.get}`,
+    `${NODE_MCP.goal.name}_${NODE_MCP.goal.tools.get}`,
+    `mcp__${NODE_MCP.goal.name}__${NODE_MCP.goal.tools.get}`
+]);
 function isGoalProgressItem(item) {
     if (!isPlainRecord(item) || typeof item.kind !== 'string')
         return false;
@@ -2529,5 +2491,7 @@ function isGoalProgressItem(item) {
     if (item.kind !== 'tool_call' || !isPlainRecord(item.payload))
         return false;
     const toolName = item.payload.toolName;
-    return typeof toolName === 'string' && !toolName.endsWith('mar_get_goal');
+    return (typeof toolName === 'string' &&
+        !goalReadToolNames.has(toolName) &&
+        !(item.payload.namespace === NODE_MCP.goal.name && toolName === NODE_MCP.goal.tools.get));
 }

package/dist/mcp/configuration.js

@@ -0,0 +1,107 @@
+import { createHash } from 'node:crypto';
+import { mcpRuntimeDescriptorSchema } from '@myagentroam/protocol';
+import { nodeExecutionEnvironment } from '../node-execution-environment.js';
+import { canonicalJson } from '../util/canonical-json.js';
+import { assertMcpServerNames } from './naming.js';
+export function resolveMcpServers(raw, secrets, executionServers = []) {
+    const installations = Array.isArray(raw) ? raw : [];
+    const marctlEnvironment = {
+        MAR_USERNAME: secrets['MAR_USERNAME'] ?? '',
+        ...(secrets['MAR_CTL_SERVER_URL'] === undefined
+            ? {}
+            : { MAR_CTL_SERVER_URL: secrets['MAR_CTL_SERVER_URL'] }),
+        ...(secrets['MAR_CTL_USER_TOKEN'] === undefined
+            ? {}
+            : { MAR_CTL_USER_TOKEN: secrets['MAR_CTL_USER_TOKEN'] }),
+        MAR_CTL_CONTEXT_REQUIRED: '1'
+    };
+    const mcpEnvironment = (provided) => nodeExecutionEnvironment({ ...provided, ...marctlEnvironment }, { PATH: process.env['PATH'], Path: process.env['Path'] });
+    const result = [];
+    for (const value of installations) {
+        if (value === null || typeof value !== 'object' || Array.isArray(value))
+            continue;
+        const record = value;
+        if (typeof record['serverName'] !== 'string' || record['enabled'] !== true)
+            continue;
+        const runtime = mcpRuntimeDescriptorSchema.safeParse(record['runtime']);
+        if (!runtime.success)
+            continue;
+        const configuration = isRecord(record['configuration']) ? record['configuration'] : {};
+        const sourceIdentity = createHash('sha256')
+            .update(canonicalJson({
+            id: record['id'] ?? null,
+            name: record['serverName'],
+            runtime: runtime.data,
+            configuration
+        }))
+            .digest('hex');
+        const authorizationIdentity = secrets['MAR_USERNAME']?.trim() || undefined;
+        const resolveReferences = (candidate) => {
+            if (!isRecord(candidate))
+                return {};
+            const result = {};
+            for (const [name, reference] of Object.entries(candidate)) {
+                if (!isRecord(reference) || typeof reference['secretName'] !== 'string')
+                    return undefined;
+                const secret = secrets[reference['secretName']];
+                if (secret === undefined)
+                    return undefined;
+                result[name] = secret;
+            }
+            return result;
+        };
+        if (runtime.data.transport === 'STDIO') {
+            const runtimeEnvironment = resolveReferences(runtime.data.environment);
+            const configuredEnvironment = resolveReferences(configuration['environment']);
+            if (runtimeEnvironment === undefined || configuredEnvironment === undefined)
+                continue;
+            result.push({
+                name: record['serverName'],
+                origin: 'USER',
+                sourceIdentity,
+                ...(authorizationIdentity === undefined ? {} : { authorizationIdentity }),
+                transport: 'STDIO',
+                command: runtime.data.command,
+                args: [
+                    ...runtime.data.args,
+                    ...(Array.isArray(configuration['arguments'])
+                        ? configuration['arguments'].filter((item) => typeof item === 'string')
+                        : [])
+                ],
+                environment: mcpEnvironment({
+                    ...runtimeEnvironment,
+                    ...configuredEnvironment
+                })
+            });
+        }
+        else {
+            const runtimeHeaders = resolveReferences(runtime.data.headers);
+            const configuredHeaders = resolveReferences(configuration['headers']);
+            if (runtimeHeaders === undefined || configuredHeaders === undefined)
+                continue;
+            result.push({
+                name: record['serverName'],
+                origin: 'USER',
+                sourceIdentity,
+                ...(authorizationIdentity === undefined ? {} : { authorizationIdentity }),
+                transport: 'HTTP',
+                url: runtime.data.url,
+                headers: {
+                    ...runtimeHeaders,
+                    ...configuredHeaders
+                }
+            });
+        }
+    }
+    const servers = [
+        ...result,
+        ...executionServers.map((server) => server.transport === 'STDIO'
+            ? { ...server, environment: mcpEnvironment(server.environment ?? {}) }
+            : server)
+    ];
+    assertMcpServerNames(servers);
+    return servers;
+}
+function isRecord(value) {
+    return value !== null && typeof value === 'object' && !Array.isArray(value);
+}

package/dist/mcp/naming.js

@@ -0,0 +1,42 @@
+import { createRequire } from 'node:module';
+export const NODE_MCP = {
+    goal: { name: 'mar_goal', tools: { get: 'get_goal', update: 'update_goal' } },
+    schedule: {
+        name: 'mar_schedule',
+        tools: {
+            get: 'get_scheduled_task',
+            create: 'create_scheduled_task',
+            update: 'update_scheduled_task'
+        }
+    },
+    notification: {
+        name: 'mar_notification',
+        tools: { send: 'send_notification', email: 'send_email_notification' }
+    },
+    computer: { name: 'mar_computer', tools: { exec: 'exec' } },
+    channel: { name: 'mar_channel', tools: { reply: 'reply' } }
+};
+const { version } = createRequire(import.meta.url)('../../package.json');
+export const NODE_MCP_VERSION = version;
+export const NODE_MCP_CLIENT_INFO = { name: 'mar-node', version };
+export const NODE_COMPUTER_TOOL_NAME = [
+    'mcp',
+    NODE_MCP.computer.name,
+    NODE_MCP.computer.tools.exec
+].join('__');
+const reservedNames = new Set(Object.values(NODE_MCP).map(({ name }) => name));
+export function mcpNameAlias(value) {
+    return value.replace(/[^a-zA-Z0-9_-]/gu, '_').slice(0, 64);
+}
+/** Validate the final effective set, including trusted execution-only servers. */
+export function assertMcpServerNames(servers) {
+    const seen = new Set();
+    for (const server of servers) {
+        const alias = mcpNameAlias(server.name);
+        if (server.origin !== 'BUILTIN' && reservedNames.has(alias))
+            throw Object.assign(new Error('MCP_RESERVED_NAMESPACE: The MCP server name is reserved for Node.'), { code: 'MCP_RESERVED_NAMESPACE' });
+        if (seen.has(alias))
+            throw Object.assign(new Error('MCP_SERVER_NAME_CONFLICT: Multiple MCP servers have the same exposed name.'), { code: 'MCP_SERVER_NAME_CONFLICT' });
+        seen.add(alias);
+    }
+}

package/dist/runner/abstract-runner.js

@@ -1,7 +1,4 @@
-import { createHash } from 'node:crypto';
-import { mcpRuntimeDescriptorSchema } from '@myagentroam/protocol';
-import { nodeExecutionEnvironment } from '../node-execution-environment.js';
-import { canonicalJson } from '../util/canonical-json.js';
+import { resolveMcpServers } from '../mcp/configuration.js';
 /**
  * Stable lifecycle boundary for every Node Runner implementation.
  *
@@ -40,8 +37,8 @@ export class AbstractRunner {
         void collaborationMode;
         return input;
     }
-    mcpConfiguration(rawInstallations, secretEnvironment) {
-        return resolvedMcpServers(rawInstallations, secretEnvironment);
+    mcpConfiguration(rawInstallations, secretEnvironment, executionServers = []) {
+        return resolveMcpServers(rawInstallations, secretEnvironment, executionServers);
     }
     channelToken(sessionId) {
         void sessionId;
@@ -178,154 +175,6 @@ export class AbstractRunner {
         return this.commandControl.execute(session, command, input, context);
     }
 }
-function resolvedMcpServers(raw, secrets) {
-    if (!Array.isArray(raw))
-        return [];
-    const marctlEnvironment = {
-        MAR_USERNAME: secrets['MAR_USERNAME'] ?? '',
-        ...(secrets['MAR_CTL_SERVER_URL'] === undefined
-            ? {}
-            : { MAR_CTL_SERVER_URL: secrets['MAR_CTL_SERVER_URL'] }),
-        ...(secrets['MAR_CTL_USER_TOKEN'] === undefined
-            ? {}
-            : { MAR_CTL_USER_TOKEN: secrets['MAR_CTL_USER_TOKEN'] }),
-        MAR_CTL_CONTEXT_REQUIRED: '1'
-    };
-    const mcpEnvironment = (provided) => nodeExecutionEnvironment({ ...provided, ...marctlEnvironment }, { PATH: process.env['PATH'], Path: process.env['Path'] });
-    const result = [];
-    for (const value of raw) {
-        if (value === null || typeof value !== 'object' || Array.isArray(value))
-            continue;
-        const record = value;
-        if (typeof record['serverName'] !== 'string' || record['enabled'] !== true)
-            continue;
-        if ((record['__marGoal'] === true ||
-            record['__marScheduled'] === true ||
-            record['__marMail'] === true) &&
-            typeof record['command'] === 'string' &&
-            Array.isArray(record['args']) &&
-            record['args'].every((value) => typeof value === 'string') &&
-            typeof record['endpoint'] === 'string' &&
-            typeof record['secretName'] === 'string' &&
-            secrets[record['secretName']] !== undefined) {
-            result.push({
-                name: record['serverName'],
-                lifecycle: 'EXECUTION',
-                origin: 'BUILTIN',
-                allowedToolCallers: record['__marGoal'] === true
-                    ? {
-                        mar_get_goal: ['direct', 'programmatic'],
-                        mar_update_goal: ['direct', 'programmatic']
-                    }
-                    : record['__marScheduled'] === true
-                        ? {
-                            mar_get_scheduled_task: ['direct', 'programmatic'],
-                            mar_create_scheduled_task: ['direct', 'programmatic'],
-                            mar_update_scheduled_task: ['direct', 'programmatic']
-                        }
-                        : {
-                            mar_send_email_notification: ['direct', 'programmatic'],
-                            ...(record['notificationChannels'] === true
-                                ? { mar_send_notification: ['direct', 'programmatic'] }
-                                : {})
-                        },
-                transport: 'STDIO',
-                command: record['command'],
-                args: record['args'],
-                environment: mcpEnvironment(record['__marGoal'] === true
-                    ? {
-                        MAR_GOAL_MCP_ENDPOINT: record['endpoint'],
-                        MAR_GOAL_MCP_TOKEN: secrets[record['secretName']]
-                    }
-                    : record['__marScheduled'] === true
-                        ? {
-                            MAR_SCHEDULE_MCP_ENDPOINT: record['endpoint'],
-                            MAR_SCHEDULE_MCP_TOKEN: secrets[record['secretName']],
-                            MAR_SCHEDULE_MCP_READ_ONLY: record['readOnly'] === true ? '1' : '0'
-                        }
-                        : {
-                            MAR_MAIL_MCP_ENDPOINT: record['endpoint'],
-                            MAR_MAIL_MCP_TOKEN: secrets[record['secretName']],
-                            MAR_NOTIFICATION_CHANNELS: record['notificationChannels'] === true ? '1' : '0'
-                        })
-            });
-            continue;
-        }
-        const runtime = mcpRuntimeDescriptorSchema.safeParse(record['runtime']);
-        if (!runtime.success)
-            continue;
-        const configuration = isRecord(record['configuration']) ? record['configuration'] : {};
-        const sourceIdentity = createHash('sha256')
-            .update(canonicalJson({
-            id: record['id'] ?? null,
-            name: record['serverName'],
-            runtime: runtime.data,
-            configuration
-        }))
-            .digest('hex');
-        const authorizationIdentity = secrets['MAR_USERNAME']?.trim() || undefined;
-        const resolveReferences = (candidate) => {
-            if (!isRecord(candidate))
-                return {};
-            const result = {};
-            for (const [name, reference] of Object.entries(candidate)) {
-                if (!isRecord(reference) || typeof reference['secretName'] !== 'string')
-                    return undefined;
-                const secret = secrets[reference['secretName']];
-                if (secret === undefined)
-                    return undefined;
-                result[name] = secret;
-            }
-            return result;
-        };
-        if (runtime.data.transport === 'STDIO') {
-            const runtimeEnvironment = resolveReferences(runtime.data.environment);
-            const configuredEnvironment = resolveReferences(configuration['environment']);
-            if (runtimeEnvironment === undefined || configuredEnvironment === undefined)
-                continue;
-            result.push({
-                name: record['serverName'],
-                origin: 'USER',
-                sourceIdentity,
-                ...(authorizationIdentity === undefined ? {} : { authorizationIdentity }),
-                transport: 'STDIO',
-                command: runtime.data.command,
-                args: [
-                    ...runtime.data.args,
-                    ...(Array.isArray(configuration['arguments'])
-                        ? configuration['arguments'].filter((item) => typeof item === 'string')
-                        : [])
-                ],
-                environment: mcpEnvironment({
-                    ...runtimeEnvironment,
-                    ...configuredEnvironment
-                })
-            });
-        }
-        else {
-            const runtimeHeaders = resolveReferences(runtime.data.headers);
-            const configuredHeaders = resolveReferences(configuration['headers']);
-            if (runtimeHeaders === undefined || configuredHeaders === undefined)
-                continue;
-            result.push({
-                name: record['serverName'],
-                origin: 'USER',
-                sourceIdentity,
-                ...(authorizationIdentity === undefined ? {} : { authorizationIdentity }),
-                transport: 'HTTP',
-                url: runtime.data.url,
-                headers: {
-                    ...runtimeHeaders,
-                    ...configuredHeaders
-                }
-            });
-        }
-    }
-    return result;
-}
-function isRecord(value) {
-    return value !== null && typeof value === 'object' && !Array.isArray(value);
-}
 export class RunnerCapabilityError extends Error {
     runner;
     capability;

package/dist/runner/claude/managed-run-controller.js

@@ -88,11 +88,9 @@ export class ClaudeManagedRunController {
             : undefined;
         let attachments;
         let secretEnvironment;
-        let mcpSecretEnvironment;
         try {
             attachments = this.host.parseAttachments(payload.attachments);
             secretEnvironment = parseSecretEnvironment(payload.secretEnvironment);
-            mcpSecretEnvironment = parseSecretEnvironment(payload.mcpSecretEnvironment);
         }
         catch (error) {
             this.host.emit(runId, 'run.rejected', { code: safeErrorCode(error, 'MESSAGE_ATTACHMENTS_INVALID') }, 'FAILED');
@@ -209,9 +207,8 @@ export class ClaudeManagedRunController {
                     : {}),
                 mcpServers: this.runner.mcpConfiguration(payload.mcpInstallations, {
                     ...secretEnvironment,
-                    ...mcpSecretEnvironment,
                     MAR_USERNAME: secretEnvironment['MAR_USERNAME'] ?? ''
-                }),
+                }, payload.executionMcpServers),
                 ...(attachments.length === 0
                     ? {}
                     : {

package/dist/runner/claude-code-runner.js

@@ -45,8 +45,8 @@ export class ClaudeCodeRunner extends AbstractRunner {
             access: 'default'
         };
     }
-    mcpConfiguration(raw, secrets) {
-        const servers = super.mcpConfiguration(raw, secrets);
+    mcpConfiguration(raw, secrets, executionServers = []) {
+        const servers = super.mcpConfiguration(raw, secrets, executionServers);
         return Object.fromEntries(servers.map((server) => [
             server.name,
             server.transport === 'STDIO'