@teamscala/service-boot 0.23.320 → 0.23.321

package/package.json

@@ -6,7 +6,7 @@
   },
   "name": "@teamscala/service-boot",
   "type": "module",
-  "version": "0.23.320",
+  "version": "0.23.321",
   "sideEffects": false,
   "files": [
     "src"

package/src/register-api-routes.ts

@@ -19,14 +19,20 @@ import { BootFatalError } from "@teamscala/os/errors/boot-error";
 import type { MountRegistry } from "@teamscala/os/runtime-contracts/mount-context";
 import type { Context, Hono } from "hono";
 import { getConnInfo } from "hono/bun";
+import { CALLER_HEADERS } from "@teamscala/os/contracts/mcp";
 
-const REMOTE_PORT_HEADER = "x-caller-remote-port";
+// From CALLER_HEADERS, never a literal: this name is one end of a contract the
+// gateway's caller-resolution reads, and a literal stores it twice. The
+// 2026-08-02 outage was that exact drift on a sibling header (reader on
+// `x-user-id`, writer on `x-caller-user-id`), and it took every tool on the
+// cloud MCP down once the branch masking it was closed.
+const REMOTE_PORT_HEADER = CALLER_HEADERS.REMOTE_PORT;
 // Verified socket-peer address (unforgeable transport origin). Sanitized
 // (client-supplied value deleted) then set from getConnInfo so handlers that
 // receive only a Request (e.g. mcp-tool-runtime/mount.ts) can gate on the
 // genuine transport origin per no-client-controlled-trust-signals — an external
 // attacker cannot make their TCP connection appear on the server's loopback.
-const REMOTE_ADDR_HEADER = "x-caller-remote-address";
+const REMOTE_ADDR_HEADER = CALLER_HEADERS.REMOTE_ADDRESS;
 
 export function registerApiRoutes(
 	app: Hono,

package/src/serve/stamp-transport-identity.ts

@@ -26,6 +26,7 @@
  * identity — a clone can never upgrade).
  */
 
+import { CALLER_HEADERS } from "@teamscala/os/contracts/mcp";
 import { resolveSocketPeer } from "@teamscala/proc-walker/socket-peer";
 
 const LOOPBACK = new Set(["127.0.0.1", "::1", "::ffff:127.0.0.1"]);
@@ -53,15 +54,15 @@ export function stampTransportIdentity(
 		const port = peer?.port;
 		const address = peer?.address ?? null;
 		const needsPort =
-			typeof port === "number" && port > 0 && !req.headers.has("x-caller-remote-port");
+			typeof port === "number" && port > 0 && !req.headers.has(CALLER_HEADERS.REMOTE_PORT);
 		// Nothing to stamp when there is no peer address and no port to add.
 		if (!needsPort && address === null) return req;
 
 		const headers = new Headers(req.headers);
-		if (needsPort) headers.set("x-caller-remote-port", String(port));
+		if (needsPort) headers.set(CALLER_HEADERS.REMOTE_PORT, String(port));
 		if (address) {
-			headers.delete("x-caller-remote-address");
-			headers.set("x-caller-remote-address", String(address));
+			headers.delete(CALLER_HEADERS.REMOTE_ADDRESS);
+			headers.set(CALLER_HEADERS.REMOTE_ADDRESS, String(address));
 		}
 		// Local-caller attribution: loopback peer + no forwarding header => a
 		// direct local fetch whose owning process we can name via /proc.
@@ -75,9 +76,9 @@ export function stampTransportIdentity(
 		) {
 			const owner = resolveSocketPeer(port);
 			if (owner) {
-				headers.set("x-caller-local-comm", owner.comm);
+				headers.set(CALLER_HEADERS.LOCAL_COMM, owner.comm);
 				const cmd = owner.cmdline.join(" ").trim();
-				if (cmd) headers.set("x-caller-local-cmd", cmd.slice(0, 160));
+				if (cmd) headers.set(CALLER_HEADERS.LOCAL_CMD, cmd.slice(0, 160));
 			}
 		}
 		return new Request(req.url, {