@nanobpm/urban 0.84.0 → 0.86.0

package/src/runtime/core/modules/surfaces.test.ts

@@ -408,3 +408,19 @@ test("/api/complete rejects a body with no userTaskKey", async () => {
   assert.equal(res.status, 400);
 });
 
+
+test("MCP is listed as an active surface only when config-enabled, but its route is always mounted", () => {
+  // Default: MCP enabled -> listed as an active surface.
+  const on = mountSurfaces(ctxWith({}), fakeApp);
+  const onEnabled = on.describe().enabled;
+  assert.ok(Array.isArray(onEnabled) && onEnabled.includes("mcp@/app/mcp"), "an enabled MCP surface is listed as active");
+
+  // Config-disabled (URBAN_MCP_ENABLED=false): the handler 404s, so it must NOT appear as active,
+  // yet the route stays mounted for a stable address.
+  const base = ctxWith({});
+  const offCtx = { ...base, host: { ...base.host, env: (v: string) => (v === "URBAN_MCP_ENABLED" ? "false" : undefined) } };
+  const off = mountSurfaces(offCtx, fakeApp);
+  const offEnabled = off.describe().enabled;
+  assert.ok(Array.isArray(offEnabled) && !offEnabled.includes("mcp@/app/mcp"), "a disabled MCP surface must not be listed as active");
+  assert.ok(off.routes.some((r) => r.path === "/app/mcp"), "the MCP route stays mounted even when disabled");
+});

package/src/runtime/core/modules/surfaces.ts

@@ -14,6 +14,7 @@ import { completeUserTaskResponse, resolveFormResponse } from "./forms.ts";
 import { mountActions } from "./actions.ts";
 import { mountAgent } from "./agent.ts";
 import { mountApi } from "./api.ts";
+import { mountMcp } from "./mcp.ts";
 import { mountPages } from "./pages.ts";
 
 /** Escape HTML-significant characters before embedding a value in markup. */
@@ -211,6 +212,16 @@ export function mountSurfaces(ctx: RuntimeContext, app: AppApi): SurfacesHandle
   routes.push(...agent.routes);
   enabled.push("agent@/app/agent");
 
+  // The runtime-served MCP surface (ADR 0067): `/app/mcp`, a Streamable-HTTP MCP endpoint mounted
+  // unconditionally (like `/app/agent`) so an MCP client always has a stable address. It projects
+  // the app's read-only OpenAPI operations as tools from the SAME enumeration `mountApi` routes
+  // from, plus framework-owned read-only process-debugging tools — zero app-side MCP code.
+  const mcp = mountMcp(ctx, app, api.routes);
+  routes.push(...mcp.routes);
+  // The route is always mounted (stable address), but only claim MCP as an active surface when it
+  // actually answers — a config-disabled surface 404s, so listing it here would be inaccurate.
+  if (mcp.enabled) enabled.push("mcp@/app/mcp");
+
   // The pages surface (the schema-driven page runtime) mounts its own routes.
   const pages = mountPages(ctx, app);
   if (pages.routes.length > 0) {