@tenkicloud/mcp 0.1.0 → 0.3.0

package/dist/client.js

@@ -71,6 +71,17 @@ const CRED_EXPIRY_SKEW_MS = 30_000;
 const MIN_CRED_TTL_MS = 5_000; // floor for the skewed expiry of a short-lived credential
 /** Home directory of the sandbox's `tenki` user; run-code scripts and capture files live here. */
 const SANDBOX_HOME = "/home/tenki";
+// Inline-output budget per stream (stdout / stderr), in bytes. Outputs at or
+// under the cap return whole; larger ones return a head+tail preview and the
+// full capture file is KEPT in the sandbox so the caller can page through it.
+// The cap exists for the consumer (an LLM context) and for this process: the
+// data plane's ReadFile has no range support, so the only alternative to a
+// server-side preview would be pulling the entire body over the wire.
+const DEFAULT_MAX_OUTPUT_BYTES = 65_536;
+const MIN_OUTPUT_BYTES = 1_024;
+// Head-heavy split: the start of a log names the command/failure context; the
+// tail carries the final error. 3:1 mirrors how people read build output.
+const TRUNCATE_HEAD_FRACTION = 0.75;
 const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
 function safeJson(text) {
     try {
@@ -117,6 +128,8 @@ export class TenkiClient {
     execTimeoutMs;
     slowTimeoutMs;
     credTtlMs;
+    workspaceId;
+    bearerTokenProvider;
     constructor(token, baseUrl = DEFAULT_BASE_URL, opts = {}) {
         this.token = token;
         this.baseUrl = baseUrl.replace(/\/+$/, "");
@@ -124,6 +137,13 @@ export class TenkiClient {
         this.execTimeoutMs = opts.execTimeoutMs ?? DEFAULT_EXEC_TIMEOUT_MS;
         this.slowTimeoutMs = opts.slowTimeoutMs ?? DEFAULT_SLOW_TIMEOUT_MS;
         this.credTtlMs = opts.credTtlMs ?? DEFAULT_CRED_TTL_MS;
+        this.workspaceId = opts.workspaceId?.trim() || undefined;
+        this.bearerTokenProvider = opts.bearerTokenProvider;
+    }
+    controlAuthHeaders() {
+        if (this.bearerTokenProvider)
+            return { Authorization: `Bearer ${this.bearerTokenProvider()}` };
+        return authHeaders(this.token);
     }
     /**
      * ExecuteCommand blocks until the command finishes, so its timeout follows
@@ -196,7 +216,7 @@ export class TenkiClient {
             try {
                 res = await this.fetchTextWithTimeout(url, {
                     method: "POST",
-                    headers: { "Content-Type": "application/json", "Connect-Protocol-Version": "1", ...authHeaders(this.token) },
+                    headers: { "Content-Type": "application/json", "Connect-Protocol-Version": "1", ...this.controlAuthHeaders() },
                     body: JSON.stringify(body ?? {}),
                 }, deadline - Date.now(), method);
             }
@@ -335,9 +355,10 @@ export class TenkiClient {
         }
     }
     /**
-     * Resolve the calling identity + a default workspace/project for CreateSession
-     * (which requires a projectId). Picks the first workspace that has a project so
-     * the (workspace, project) pair stays consistent.
+     * Resolve the calling identity + a default workspace for CreateSession and
+     * other workspace-scoped calls. (Projects were removed from the API — the
+     * proto reserves every project_id field and WhoAmI no longer lists projects —
+     * so there is nothing narrower than a workspace to resolve.)
      *
      * CreateSession validates owner_type ∈ {SERVICE, USER} and requires a
      * non-empty owner_id, but derives the real owner from the authenticated
@@ -348,8 +369,9 @@ export class TenkiClient {
     async resolveOwner() {
         const resp = await this.control("WhoAmI", {});
         const workspaces = Array.isArray(resp.workspaces) ? resp.workspaces : [];
-        const ws = workspaces.find((w) => Array.isArray(w?.projects) && w.projects.length > 0) ?? workspaces[0];
-        const proj = Array.isArray(ws?.projects) ? ws.projects[0] : undefined;
+        const ws = this.workspaceId
+            ? workspaces.find((candidate) => (candidate?.workspaceId ?? candidate?.id) === this.workspaceId)
+            : workspaces[0];
         let ownerType = resp.ownerType;
         let ownerId = resp.ownerId;
         // Substitute the placeholder only when WhoAmI returned a type CreateSession
@@ -362,8 +384,7 @@ export class TenkiClient {
         return {
             ownerType,
             ownerId,
-            workspaceId: ws?.workspaceId ?? ws?.id,
-            projectId: proj?.projectId ?? proj?.id,
+            workspaceId: this.workspaceId ?? ws?.workspaceId ?? ws?.id,
         };
     }
     /** Poll GetSession until it reaches (or passes into) the target state. */
@@ -393,6 +414,37 @@ export class TenkiClient {
         const content = Buffer.from(text, "utf8").toString("base64");
         return this.data(sessionId, "WriteFile", { path, content });
     }
+    /**
+     * Read a capture file back, capping what crosses the wire. Stat first: a
+     * file at or under the cap is read whole; a larger one gets a server-side
+     * head+tail preview (assembled by `sh` in the sandbox, so the full body
+     * never leaves it — ReadFile has no range support). The preview file is the
+     * caller's to clean up (returned as previewPath); the ORIGINAL is theirs to
+     * keep, so the user can page through the full output afterwards.
+     */
+    async readCaptureFile(sessionId, path, capBytes) {
+        // Stat is an optimization (skip pulling a body we'd mostly discard), not a
+        // gate: if it fails, fall back to the plain whole read — whose own failure
+        // still surfaces as captureError in the caller.
+        let size;
+        try {
+            const stat = await this.data(sessionId, "Stat", { path });
+            size = Number(stat.size ?? 0); // int64 arrives as a JSON string
+        }
+        catch {
+            size = undefined;
+        }
+        if (size === undefined || !Number.isFinite(size) || size <= capBytes) {
+            return { text: await this.readTextFile(sessionId, path), truncated: false };
+        }
+        const head = Math.floor(capBytes * TRUNCATE_HEAD_FRACTION);
+        const tail = capBytes - head;
+        const previewPath = `${path}.preview`;
+        const marker = `\n[... output truncated: ${size} bytes total, showing the first ${head} and last ${tail}. Full output kept in the sandbox at ${path} ...]\n`;
+        const script = `{ head -c ${head} ${shellQuote(path)}; printf %s ${shellQuote(marker)}; tail -c ${tail} ${shellQuote(path)}; } > ${shellQuote(previewPath)}`;
+        await this.control("ExecuteCommand", { sessionId, command: "sh", args: ["-c", script] });
+        return { text: await this.readTextFile(sessionId, previewPath), truncated: true, previewPath };
+    }
     /**
      * Run a command in a session and return stdout/stderr inline.
      *
@@ -401,7 +453,9 @@ export class TenkiClient {
      * client. Capture-read failures degrade gracefully into `captureError` rather
      * than losing the run — but the result is marked NOT ok, because empty
      * stdout/stderr next to a zero exit code would otherwise read as a clean,
-     * silent success.
+     * silent success. Streams over maxOutputBytes come back truncated
+     * (head+tail) with the full capture file retained in the sandbox — see
+     * readCaptureFile; truncation does not affect `ok`.
      */
     async execCaptured(sessionId, command, opts = {}) {
         const suffix = `${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 8)}`;
@@ -428,18 +482,39 @@ export class TenkiClient {
         // unparseable code to -1 so the user still gets their stdout/stderr.
         const rawExit = typeof execution.exitCode === "number" ? execution.exitCode : Number(execution.exitCode ?? 0);
         const exitCode = Number.isFinite(rawExit) ? Math.trunc(rawExit) : -1;
+        const cap = Math.max(MIN_OUTPUT_BYTES, Math.floor(opts.maxOutputBytes ?? DEFAULT_MAX_OUTPUT_BYTES));
         let stdout = "";
         let stderr = "";
         let captureError;
+        let stdoutTruncated = false;
+        let stderrTruncated = false;
+        // Truncated originals are KEPT (their path is returned) so the caller can
+        // page through them; everything else — untruncated captures, previews — is
+        // removed.
+        const toRemove = [];
         try {
-            stdout = await this.readTextFile(sessionId, outPath);
-            stderr = await this.readTextFile(sessionId, errPath);
+            const [out, err] = await Promise.all([
+                this.readCaptureFile(sessionId, outPath, cap),
+                this.readCaptureFile(sessionId, errPath, cap),
+            ]);
+            stdout = out.text;
+            stderr = err.text;
+            stdoutTruncated = out.truncated;
+            stderrTruncated = err.truncated;
+            if (out.previewPath)
+                toRemove.push(out.previewPath);
+            if (err.previewPath)
+                toRemove.push(err.previewPath);
         }
         catch (e) {
             captureError = e.message;
         }
+        if (!stdoutTruncated)
+            toRemove.push(outPath);
+        if (!stderrTruncated)
+            toRemove.push(errPath);
         try {
-            await this.control("ExecuteCommand", { sessionId, command: "rm", args: ["-f", outPath, errPath] });
+            await this.control("ExecuteCommand", { sessionId, command: "rm", args: ["-f", ...toRemove] });
         }
         catch {
             // Session may have gone away; capture files die with it.
@@ -452,6 +527,8 @@ export class TenkiClient {
             exitCode,
             ok: exitCode === 0 && !captureError,
             ...(captureError ? { captureError } : {}),
+            ...(stdoutTruncated ? { stdoutTruncated: true, stdoutPath: outPath } : {}),
+            ...(stderrTruncated ? { stderrTruncated: true, stderrPath: errPath } : {}),
         };
     }
     /**
@@ -469,7 +546,6 @@ export class TenkiClient {
             ...(owner.ownerType ? { ownerType: owner.ownerType } : {}),
             ...(owner.ownerId ? { ownerId: owner.ownerId } : {}),
             ...(owner.workspaceId ? { workspaceId: owner.workspaceId } : {}),
-            ...(owner.projectId ? { projectId: owner.projectId } : {}),
             ...(opts.env && Object.keys(opts.env).length ? { env: opts.env } : {}),
         });
         const session = create.session ?? create;

package/dist/http.d.ts

@@ -8,12 +8,10 @@
  *   TENKI_MCP_HTTP_HOST    — bind host (default 127.0.0.1, loopback-only)
  *   TENKI_MCP_HTTP_TOKEN   — required Bearer token for the /mcp endpoint
  *
- * Security posture (the process holds one shared TENKI_API_KEY and exposes all
- * tools, incl. arbitrary code execution + credit spend, so the endpoint is a
- * capability): loopback-only by default; DNS-rebinding protection on (Host
- * allowlist); optional bearer auth; and it REFUSES to bind to a non-loopback
- * host without a token set. Per-session/global DoS caps are applied.
+ * Security posture: loopback-only by default; DNS-rebinding protection on
+ * (Host allowlist); static bearer auth or OAuth required for non-loopback
+ * binds; and per-session/global DoS caps are applied.
  */
 import http from "node:http";
-import type { TenkiClient } from "./client.js";
+import { TenkiClient } from "./client.js";
 export declare function startHttp(client: TenkiClient | null, port: number): http.Server;

package/dist/http.js

@@ -8,16 +8,16 @@
  *   TENKI_MCP_HTTP_HOST    — bind host (default 127.0.0.1, loopback-only)
  *   TENKI_MCP_HTTP_TOKEN   — required Bearer token for the /mcp endpoint
  *
- * Security posture (the process holds one shared TENKI_API_KEY and exposes all
- * tools, incl. arbitrary code execution + credit spend, so the endpoint is a
- * capability): loopback-only by default; DNS-rebinding protection on (Host
- * allowlist); optional bearer auth; and it REFUSES to bind to a non-loopback
- * host without a token set. Per-session/global DoS caps are applied.
+ * Security posture: loopback-only by default; DNS-rebinding protection on
+ * (Host allowlist); static bearer auth or OAuth required for non-loopback
+ * binds; and per-session/global DoS caps are applied.
  */
 import http from "node:http";
 import { randomUUID, timingSafeEqual } from "node:crypto";
 import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
 import { isInitializeRequest } from "@modelcontextprotocol/sdk/types.js";
+import { TenkiClient } from "./client.js";
+import { OAuthResourceRoutes, OAuthTokenVerifier, authorizationBinding, bearerToken, loadOAuthConfig, } from "./oauth.js";
 import { createServer } from "./server.js";
 const MAX_BODY_BYTES = 1 << 20; // 1 MiB — reject larger POST bodies (memory-DoS guard)
 const MAX_SESSIONS = 256; // cap concurrent sessions (init-flood DoS guard)
@@ -109,22 +109,41 @@ function authOk(header, expected) {
  * an ephemeral `port: 0` bind still accepts its own address). Anything else —
  * e.g. a rebound attacker domain — is rejected by the transport.
  */
-function allowedHostsFor(server, host, port) {
+function allowedHostsFor(server, host, port, publicUrl) {
     const addr = server.address();
     const bound = addr && typeof addr === "object" ? addr.port : port;
     const ports = Array.from(new Set([port, bound]));
     const hosts = Array.from(new Set([host, "127.0.0.1", "localhost", "[::1]", "::1"]));
-    return hosts.flatMap((h) => ports.map((p) => `${h}:${p}`));
+    const configured = (process.env.TENKI_MCP_ALLOWED_HOSTS || "")
+        .split(",")
+        .map((value) => value.trim())
+        .filter(Boolean);
+    if (publicUrl) {
+        const url = new URL(publicUrl);
+        configured.push(url.host, url.hostname);
+    }
+    return Array.from(new Set([...hosts.flatMap((h) => ports.map((p) => `${h}:${p}`)), ...configured]));
+}
+function oauthUnauthorized(res, metadataUrl, scope) {
+    res
+        .writeHead(401, {
+        "Content-Type": "application/json",
+        "Cache-Control": "no-store",
+        "WWW-Authenticate": `Bearer resource_metadata="${metadataUrl}", scope="${scope}"`,
+    })
+        .end(JSON.stringify({ error: "unauthorized" }));
 }
 export function startHttp(client, port) {
     const host = process.env.TENKI_MCP_HTTP_HOST || "127.0.0.1";
     const httpToken = process.env.TENKI_MCP_HTTP_TOKEN || "";
     const isLoopback = host === "127.0.0.1" || host === "::1" || host === "localhost";
+    const oauthConfig = loadOAuthConfig();
+    const oauthVerifier = oauthConfig ? new OAuthTokenVerifier(oauthConfig) : null;
+    const oauthRoutes = oauthConfig ? new OAuthResourceRoutes(oauthConfig) : null;
     // Refuse to expose an unauthenticated capability to the network.
-    if (!isLoopback && !httpToken) {
+    if (!isLoopback && !httpToken && !oauthConfig) {
         console.error("tenki-mcp: refusing to bind HTTP to a non-loopback host without TENKI_MCP_HTTP_TOKEN " +
-            "(the /mcp endpoint would be unauthenticated and can spend credits / run code). " +
-            "Set TENKI_MCP_HTTP_TOKEN, or bind to 127.0.0.1.");
+            "or OAuth configuration (the /mcp endpoint would be unauthenticated and can spend credits / run code).");
         process.exit(1);
     }
     const sessions = new Map();
@@ -145,16 +164,37 @@ export function startHttp(client, port) {
     sweep.unref?.();
     const httpServer = http.createServer(async (req, res) => {
         try {
-            if (!authOk(req.headers["authorization"], httpToken)) {
-                res.writeHead(401, { "Content-Type": "text/plain" }).end("unauthorized");
-                return;
-            }
             const url = new URL(req.url || "/", `http://${host}`);
+            if (oauthRoutes && (await oauthRoutes.handle(req, res, url)))
+                return;
             if (url.pathname !== "/mcp") {
                 res.writeHead(404, { "Content-Type": "text/plain" }).end("not found — MCP endpoint is /mcp");
                 return;
             }
+            let delegated;
+            if (oauthConfig && oauthVerifier) {
+                const token = bearerToken(req.headers["authorization"]);
+                delegated = token ? await oauthVerifier.verify(token) : null;
+                if (!delegated) {
+                    oauthUnauthorized(res, oauthConfig.metadataUrl, oauthConfig.scope);
+                    return;
+                }
+            }
+            else if (!authOk(req.headers["authorization"], httpToken)) {
+                res.writeHead(401, { "Content-Type": "text/plain" }).end("unauthorized");
+                return;
+            }
             const sid = req.headers["mcp-session-id"];
+            const existingEntry = sid ? sessions.get(sid) : undefined;
+            if (existingEntry?.authorization &&
+                delegated &&
+                existingEntry.authorization.binding !== authorizationBinding(delegated)) {
+                oauthUnauthorized(res, oauthConfig.metadataUrl, oauthConfig.scope);
+                return;
+            }
+            if (existingEntry?.authorization && delegated) {
+                existingEntry.authorization.apiDelegationToken = delegated.apiDelegationToken;
+            }
             if (req.method === "POST") {
                 let body;
                 try {
@@ -172,20 +212,30 @@ export function startHttp(client, port) {
                         .end(JSON.stringify({ jsonrpc: "2.0", error: { code: -32700, message: "Parse error" }, id: null }));
                     return;
                 }
-                let entry = sid ? sessions.get(sid) : undefined;
+                let entry = existingEntry;
                 if (!entry && isInitializeRequest(body)) {
                     if (sessions.size >= MAX_SESSIONS) {
                         res.writeHead(503, { "Content-Type": "text/plain" }).end("too many sessions");
                         return;
                     }
+                    const sessionAuthorization = delegated
+                        ? {
+                            binding: authorizationBinding(delegated),
+                            apiDelegationToken: delegated.apiDelegationToken,
+                        }
+                        : undefined;
                     const transport = new StreamableHTTPServerTransport({
                         sessionIdGenerator: () => randomUUID(),
                         // DNS-rebinding defense: only accept these Host headers, so a rebound
                         // attacker-domain request from a browser is rejected.
                         enableDnsRebindingProtection: true,
-                        allowedHosts: allowedHostsFor(httpServer, host, port),
+                        allowedHosts: allowedHostsFor(httpServer, host, port, oauthConfig?.publicUrl),
                         onsessioninitialized: (id) => {
-                            sessions.set(id, { transport, lastSeen: Date.now() });
+                            sessions.set(id, {
+                                transport,
+                                lastSeen: Date.now(),
+                                ...(sessionAuthorization ? { authorization: sessionAuthorization } : {}),
+                            });
                         },
                     });
                     transport.onclose = () => {
@@ -193,8 +243,18 @@ export function startHttp(client, port) {
                         if (id)
                             sessions.delete(id);
                     };
-                    await createServer(client).connect(transport);
-                    entry = { transport, lastSeen: Date.now() };
+                    const sessionClient = delegated
+                        ? new TenkiClient("", process.env.TENKI_API_ENDPOINT || process.env.TENKI_API_URL || undefined, {
+                            workspaceId: delegated.workspaceId,
+                            bearerTokenProvider: () => sessionAuthorization.apiDelegationToken,
+                        })
+                        : client;
+                    await createServer(sessionClient).connect(transport);
+                    entry = {
+                        transport,
+                        lastSeen: Date.now(),
+                        ...(sessionAuthorization ? { authorization: sessionAuthorization } : {}),
+                    };
                 }
                 if (!entry) {
                     res.writeHead(400, { "Content-Type": "application/json" }).end(JSON.stringify({ jsonrpc: "2.0", error: { code: -32000, message: "No valid session; send an initialize request first." }, id: null }));
@@ -228,7 +288,7 @@ export function startHttp(client, port) {
     httpServer.on("close", () => clearInterval(sweep));
     httpServer.listen(port, host, () => {
         console.error(`tenki-mcp running on http://${host}:${port}/mcp (Streamable HTTP)` +
-            (httpToken ? " [bearer auth required]" : " [loopback only, no auth]"));
+            (oauthConfig ? " [OAuth required]" : httpToken ? " [bearer auth required]" : " [loopback only, no auth]"));
     });
     return httpServer;
 }

package/dist/index.js

@@ -23,10 +23,11 @@ import { startHttp } from "./http.js";
 // tenki_auth_status registered (see createServer), so an agent can ask what is
 // wrong and relay the fix.
 const token = process.env.TENKI_AUTH_TOKEN || process.env.TENKI_API_KEY;
-if (!token) {
+const oauthHttp = Boolean(process.env.TENKI_MCP_OAUTH_ISSUER);
+if (!token && !oauthHttp) {
     console.error("tenki-mcp: no credential — starting in unauthenticated mode (only tenki_auth_status is available). " +
         "Set TENKI_API_KEY (tk_…) or TENKI_AUTH_TOKEN (ory_st_…) in the server's env and restart, " +
-        "e.g. claude mcp add tenki --env TENKI_API_KEY=tk_… -- npx -y tenki-mcp");
+        "e.g. claude mcp add tenki --env TENKI_API_KEY=tk_… -- npx -y @tenkicloud/mcp");
 }
 const baseUrl = process.env.TENKI_API_ENDPOINT || process.env.TENKI_API_URL || undefined;
 /** Positive integer from env, or undefined so the client keeps its own default. */

package/dist/oauth.d.ts

@@ -0,0 +1,33 @@
+import type http from "node:http";
+export interface OAuthConfig {
+    issuer: string;
+    resource: string;
+    publicUrl: string;
+    metadataUrl: string;
+    identityUrl: string;
+    identityServiceToken: string;
+    scope: string;
+}
+export interface DelegatedAuthorization {
+    tokenDigest: string;
+    subject: string;
+    workspaceId: string;
+    clientId: string;
+    scope: string[];
+    expiresAt?: number;
+    apiDelegationToken: string;
+}
+export declare function loadOAuthConfig(): OAuthConfig | null;
+export declare class OAuthTokenVerifier {
+    private readonly config;
+    private readonly cache;
+    constructor(config: OAuthConfig);
+    verify(token: string): Promise<DelegatedAuthorization | null>;
+}
+export declare class OAuthResourceRoutes {
+    private readonly config;
+    constructor(config: OAuthConfig);
+    handle(_req: http.IncomingMessage, res: http.ServerResponse, url: URL): Promise<boolean>;
+}
+export declare function bearerToken(header: string | undefined): string | null;
+export declare function authorizationBinding(authorization: DelegatedAuthorization): string;

package/dist/oauth.js

@@ -0,0 +1,146 @@
+import { createHash } from "node:crypto";
+const DEFAULT_SCOPE = "mcp";
+const FETCH_TIMEOUT_MS = 8_000;
+const TOKEN_CACHE_MS = 15_000;
+const EXCHANGE_PROCEDURE = "/tenki.cloud.identity.private.v1beta1.IdentityPrivateService/ExchangeMcpOAuthToken";
+function trimUrl(value) {
+    return value.trim().replace(/\/+$/, "");
+}
+export function loadOAuthConfig() {
+    const issuer = trimUrl(process.env.TENKI_MCP_OAUTH_ISSUER || "");
+    const identityUrl = trimUrl(process.env.TENKI_MCP_IDENTITY_URL || "");
+    const identityServiceToken = (process.env.TENKI_MCP_IDENTITY_SERVICE_TOKEN || "").trim();
+    const publicUrl = trimUrl(process.env.TENKI_MCP_PUBLIC_URL || "");
+    if (!issuer && !identityUrl && !identityServiceToken && !publicUrl)
+        return null;
+    if (!issuer || !identityUrl || !identityServiceToken || !publicUrl) {
+        throw new Error("TENKI_MCP_OAUTH_ISSUER, TENKI_MCP_IDENTITY_URL, TENKI_MCP_IDENTITY_SERVICE_TOKEN, and TENKI_MCP_PUBLIC_URL must be set together.");
+    }
+    const resource = trimUrl(process.env.TENKI_MCP_OAUTH_RESOURCE || `${publicUrl}/mcp`);
+    return {
+        issuer,
+        resource,
+        publicUrl,
+        metadataUrl: `${publicUrl}/.well-known/oauth-protected-resource/mcp`,
+        identityUrl,
+        identityServiceToken,
+        scope: (process.env.TENKI_MCP_OAUTH_SCOPE || DEFAULT_SCOPE).trim(),
+    };
+}
+function tokenDigest(token) {
+    return createHash("sha256").update(token).digest("hex");
+}
+function stringArray(value) {
+    return Array.isArray(value) ? value.filter((item) => typeof item === "string") : [];
+}
+async function fetchJson(url, init = {}) {
+    const response = await fetch(url, { ...init, signal: AbortSignal.timeout(FETCH_TIMEOUT_MS) });
+    const text = await response.text();
+    let body = {};
+    try {
+        body = text ? JSON.parse(text) : {};
+    }
+    catch {
+        throw new Error(`upstream returned non-JSON HTTP ${response.status}`);
+    }
+    if (!response.ok)
+        throw new Error(`upstream returned HTTP ${response.status}`);
+    return body;
+}
+export class OAuthTokenVerifier {
+    config;
+    cache = new Map();
+    constructor(config) {
+        this.config = config;
+    }
+    async verify(token) {
+        const digest = tokenDigest(token);
+        const cached = this.cache.get(digest);
+        if (cached && cached.cachedUntil > Date.now())
+            return cached.authorization;
+        let body;
+        try {
+            body = await fetchJson(`${this.config.identityUrl}${EXCHANGE_PROCEDURE}`, {
+                method: "POST",
+                headers: {
+                    "X-Service-Token": this.config.identityServiceToken,
+                    "Content-Type": "application/json",
+                    "Connect-Protocol-Version": "1",
+                },
+                body: JSON.stringify({ accessToken: token }),
+            });
+        }
+        catch {
+            return null;
+        }
+        const subject = typeof body.subject === "string" ? body.subject.trim() : "";
+        const workspaceId = typeof body.workspaceId === "string" ? body.workspaceId.trim() : "";
+        const clientId = typeof body.clientId === "string" ? body.clientId.trim() : "";
+        const apiDelegationToken = typeof body.apiDelegationToken === "string" ? body.apiDelegationToken.trim() : "";
+        const scope = stringArray(body.scopes);
+        const expiresAtUnix = Number(body.expiresAtUnix);
+        const expiresAt = Number.isFinite(expiresAtUnix) ? expiresAtUnix * 1000 : undefined;
+        if (!subject ||
+            !workspaceId ||
+            !clientId ||
+            !apiDelegationToken ||
+            !scope.includes(this.config.scope) ||
+            (expiresAt !== undefined && expiresAt <= Date.now())) {
+            return null;
+        }
+        const authorization = {
+            tokenDigest: digest,
+            subject,
+            workspaceId,
+            clientId,
+            scope,
+            ...(expiresAt !== undefined ? { expiresAt } : {}),
+            apiDelegationToken,
+        };
+        this.cache.set(digest, {
+            authorization,
+            cachedUntil: Math.min(Date.now() + TOKEN_CACHE_MS, expiresAt ?? Number.POSITIVE_INFINITY),
+        });
+        return authorization;
+    }
+}
+function json(res, status, body) {
+    res.writeHead(status, {
+        "Content-Type": "application/json",
+        "Cache-Control": "no-store",
+        Pragma: "no-cache",
+    });
+    res.end(JSON.stringify(body));
+}
+export class OAuthResourceRoutes {
+    config;
+    constructor(config) {
+        this.config = config;
+    }
+    async handle(_req, res, url) {
+        if (url.pathname === "/.well-known/oauth-protected-resource/mcp" || url.pathname === "/.well-known/oauth-protected-resource") {
+            json(res, 200, {
+                resource: this.config.resource,
+                authorization_servers: [this.config.issuer],
+                scopes_supported: [this.config.scope, "offline_access"],
+                bearer_methods_supported: ["header"],
+                resource_name: "Tenki MCP",
+            });
+            return true;
+        }
+        if (url.pathname === "/healthz") {
+            json(res, 200, { status: "ok" });
+            return true;
+        }
+        return false;
+    }
+}
+export function bearerToken(header) {
+    const match = /^Bearer (.+)$/.exec(header ?? "");
+    return match?.[1]?.trim() || null;
+}
+export function authorizationBinding(authorization) {
+    return createHash("sha256")
+        .update(JSON.stringify([authorization.subject, authorization.workspaceId, authorization.clientId]))
+        .digest("hex");
+}

package/dist/server.d.ts

@@ -14,7 +14,7 @@
  */
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import type { TenkiClient } from "./client.js";
-export declare const VERSION = "0.1.0";
+export declare const VERSION = "0.3.0";
 type Cls = "read" | "write" | "destructive";
 export declare function classifyTool(name: string): Cls;
 /**
@@ -24,7 +24,7 @@ export declare function classifyTool(name: string): Cls;
  * start — which MCP clients report as an opaque "server failed to start" —
  * the server boots with ONLY tenki_auth_status registered, so an agent can
  * discover and explain the missing credential. Registering the other tools in
- * that state would offer 84 tools that can only fail.
+ * that state would offer 70 tools that can only fail.
  */
 export declare function createServer(client: TenkiClient | null): McpServer;
 export {};

package/dist/server.js

@@ -26,12 +26,11 @@ import { registerPreviews } from "./tools/previews.js";
 import { registerSnapshots } from "./tools/snapshots.js";
 import { registerVolumes } from "./tools/volumes.js";
 import { registerTemplates } from "./tools/templates.js";
-import { registerRegistry } from "./tools/registry.js";
 import { registerWorkspace } from "./tools/workspace.js";
 import { registerArtifacts } from "./tools/artifacts.js";
 import { registerSsh } from "./tools/ssh.js";
 import { registerAuthStatus } from "./tools/auth_status.js";
-export const VERSION = "0.1.0";
+export const VERSION = "0.3.0";
 const modules = [
     registerIdentity,
     registerRun,
@@ -46,7 +45,6 @@ const modules = [
     registerSnapshots,
     registerVolumes,
     registerTemplates,
-    registerRegistry,
     registerWorkspace,
     registerArtifacts,
     registerSsh,
@@ -181,7 +179,7 @@ function guard(server, opts) {
  * start — which MCP clients report as an opaque "server failed to start" —
  * the server boots with ONLY tenki_auth_status registered, so an agent can
  * discover and explain the missing credential. Registering the other tools in
- * that state would offer 84 tools that can only fail.
+ * that state would offer 70 tools that can only fail.
  */
 export function createServer(client) {
     const server = new McpServer({ name: "tenki", version: VERSION });

package/dist/tools/auth_status.d.ts

@@ -13,8 +13,8 @@
  */
 import type { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import type { TenkiClient } from "../client.js";
-/** How a credential was supplied, derived from the token's prefix. */
-export type CredentialKind = "none" | "api_key" | "oauth_session_token" | "session_cookie";
+/** How the server authenticates API calls. */
+export type CredentialKind = "none" | "api_key" | "oauth_session_token" | "session_cookie" | "hosted_oauth";
 export interface CredentialInfo {
     kind: CredentialKind;
     /** Env var the token came from, or undefined when there is none. */