@tradejs/app 3.1.29-beta.261 → 3.1.29-beta.263

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tradejs/app",
-  "version": "3.1.29-beta.261",
+  "version": "3.1.29-beta.263",
   "description": "Installable Next.js UI for the TradeJS TypeScript framework: dashboards, backtests, charts, and runtime data.",
   "keywords": [
     "tradejs",
@@ -16,7 +16,8 @@
     "coinbase",
     "ai",
     "claude",
-    "codex"
+    "codex",
+    "jev"
   ],
   "files": [
     "README.md",
@@ -56,11 +57,13 @@
     "@chakra-ui/charts": "3.36.1",
     "@chakra-ui/react": "3.36.1",
     "@emotion/react": "^11.14.0",
-    "@tradejs/core": "^3.1.29-beta.261",
-    "@tradejs/indicators": "^3.1.29-beta.261",
-    "@tradejs/infra": "^3.1.29-beta.261",
-    "@tradejs/node": "^3.1.29-beta.261",
-    "@tradejs/types": "^3.1.29-beta.261",
+    "@modelcontextprotocol/sdk": "^1.32.1",
+    "@node-oauth/oauth2-server": "^5.3.0",
+    "@tradejs/core": "^3.1.29-beta.263",
+    "@tradejs/indicators": "^3.1.29-beta.263",
+    "@tradejs/infra": "^3.1.29-beta.263",
+    "@tradejs/node": "^3.1.29-beta.263",
+    "@tradejs/types": "^3.1.29-beta.263",
     "@types/bcryptjs": "2.4.6",
     "@types/lodash": "4.17.24",
     "@types/node": "24.13.3",
@@ -86,6 +89,7 @@
     "shiki": "3.23.0",
     "technicalindicators": "^3.1.0",
     "typescript": "5.9.3",
+    "zod": "^4.6.5",
     "zustand": "5.0.14"
   },
   "devDependencies": {

package/src/app/.well-known/oauth-authorization-server/route.ts

@@ -0,0 +1,3 @@
+import { oauthMetadata, oauthResponse } from '#app/lib/mcp/oauth';
+export const dynamic = 'force-dynamic';
+export const GET = () => oauthResponse(oauthMetadata());

package/src/app/.well-known/oauth-protected-resource/mcp/route.ts

@@ -0,0 +1,3 @@
+import { protectedResourceMetadata, oauthResponse } from '#app/lib/mcp/oauth';
+export const dynamic = 'force-dynamic';
+export const GET = () => oauthResponse(protectedResourceMetadata());

package/src/app/.well-known/oauth-protected-resource/route.ts

@@ -0,0 +1 @@
+export { dynamic, GET } from './mcp/route';

package/src/app/components/Shared/Sidebar/index.tsx

@@ -5,6 +5,7 @@ import { useRouter, usePathname } from 'next/navigation';
 import { signOut } from 'next-auth/react';
 import {
   FiActivity,
+  FiLink,
   FiBarChart2,
   FiLayers,
   FiLogOut,
@@ -17,6 +18,7 @@ export const Sidebar = () => {
   const pathname = usePathname();
 
   const navItems = [
+    { icon: FiLink, label: 'MCP connections', path: '/routes/mcp' },
     {
       icon: FiBarChart2,
       label: 'Dashboard',

package/src/app/lib/mcp/Mcp.module.css

@@ -0,0 +1,63 @@
+.main {
+  max-width: 800px;
+  margin: 40px auto;
+  padding: 24px;
+}
+.main h1 {
+  font-size: 28px;
+  font-weight: 600;
+  margin-bottom: 20px;
+}
+.main h2 {
+  font-size: 20px;
+  font-weight: 600;
+  margin-top: 28px;
+  margin-bottom: 12px;
+}
+.main h3 {
+  font-size: 17px;
+  font-weight: 600;
+  margin-bottom: 8px;
+}
+.main p {
+  line-height: 1.6;
+  margin: 12px 0;
+  overflow-wrap: anywhere;
+}
+.main pre {
+  padding: 16px;
+  border: 1px solid var(--chakra-colors-border, #444);
+  border-radius: 8px;
+  overflow-x: auto;
+  font-size: 13px;
+}
+.main button {
+  padding: 8px 16px;
+  border: 1px solid var(--chakra-colors-border, #555);
+  border-radius: 6px;
+  cursor: pointer;
+  margin: 8px 8px 8px 0;
+}
+.main button:hover {
+  background: var(--chakra-colors-bg-muted, #333);
+}
+.main button:focus-visible,
+.main input:focus-visible {
+  outline: 2px solid #60a5fa;
+  outline-offset: 3px;
+}
+.main fieldset {
+  margin: 20px 0;
+  padding: 16px;
+  border: 1px solid var(--chakra-colors-border, #444);
+  border-radius: 8px;
+}
+.main a {
+  text-decoration: underline;
+}
+.connection {
+  margin-top: 20px;
+  padding: 20px;
+  border: 1px solid var(--chakra-colors-border, #444);
+  border-radius: 8px;
+}

package/src/app/lib/mcp/artifacts.ts

@@ -0,0 +1,225 @@
+import { open, readdir, readFile, realpath, stat } from 'node:fs/promises';
+import path from 'node:path';
+import {
+  verifyRuntimeEvidenceBundle,
+  verifyRuntimeFeedbackReplayBundle,
+} from '@tradejs/node/diagnostics';
+import { mcpStorage } from '@tradejs/infra/redis';
+import {
+  isMcpRecord,
+  mcpId,
+  mcpProjectRoot,
+  readMcpDeployments,
+} from '@tradejs/node/mcp';
+
+interface CatalogEntry {
+  id: string;
+  userName: string;
+  deploymentId: string;
+  kind: 'runtime-evidence' | 'runtime-feedback-replay';
+  bundleDir: string;
+  payloadPath: string;
+  sha256: string;
+  bytes: number;
+  manifest: Record<string, unknown>;
+}
+const storageKey = (userName: string, id: string) =>
+  `artifacts:${mcpId(userName)}:${id}`;
+const MAX_CATALOG_PAYLOAD_BYTES = 64 * 1024 * 1024;
+const checkPayload = async (file: string) => {
+  const resolved = await confinedPath(file);
+  if ((await stat(resolved)).size > MAX_CATALOG_PAYLOAD_BYTES)
+    throw new Error('Artifact exceeds catalog size limit');
+  return resolved;
+};
+const dataRoot = () => path.join(mcpProjectRoot(), 'data');
+
+const confinedPath = async (file: string) => {
+  const [root, resolved] = await Promise.all([
+    realpath(dataRoot()),
+    realpath(file),
+  ]);
+  if (!resolved.startsWith(`${root}${path.sep}`))
+    throw new Error('Artifact outside data root');
+  return resolved;
+};
+
+const verifyEntry = async (
+  bundleDir: string,
+  userName: string,
+  allowed: Set<string>,
+): Promise<CatalogEntry> => {
+  const manifestPath = await confinedPath(
+    path.join(bundleDir, 'manifest.json'),
+  );
+  const manifestStat = await stat(manifestPath);
+  if (manifestStat.size > 256 * 1024) throw new Error('Manifest too large');
+  const header: unknown = JSON.parse(await readFile(manifestPath, 'utf8'));
+  if (
+    !isMcpRecord(header) ||
+    header.userName !== userName ||
+    typeof header.deploymentId !== 'string' ||
+    !allowed.has(header.deploymentId)
+  )
+    throw new Error('Artifact unavailable for this user');
+  if (header.reportType === 'runtime-evidence') {
+    await checkPayload(path.join(bundleDir, 'runtime-evidence.json'));
+    const verified = await verifyRuntimeEvidenceBundle(bundleDir);
+    if (verified.artifact.userName !== userName)
+      throw new Error('Artifact unavailable for this user');
+    return {
+      id: mcpId(
+        `${verified.manifest.artifactId}:${verified.manifest.payload.sha256}`,
+      ),
+      userName,
+      deploymentId: verified.manifest.deploymentId,
+      kind: 'runtime-evidence',
+      bundleDir,
+      payloadPath: verified.payloadPath,
+      sha256: verified.manifest.payload.sha256,
+      bytes: verified.manifest.payload.bytes,
+      manifest: verified.manifest,
+    };
+  }
+  if (header.reportType === 'runtime-feedback-replay') {
+    await checkPayload(path.join(bundleDir, 'replay-runtime-evidence.json'));
+    await checkPayload(path.join(bundleDir, 'replay.log'));
+    const verified = await verifyRuntimeFeedbackReplayBundle(bundleDir);
+    return {
+      id: mcpId(
+        `${verified.manifest.artifactId}:${verified.manifest.payloads.replayEvidence.sha256}`,
+      ),
+      userName,
+      deploymentId: verified.manifest.deploymentId,
+      kind: 'runtime-feedback-replay',
+      bundleDir,
+      payloadPath: verified.replayEvidencePath,
+      sha256: verified.manifest.payloads.replayEvidence.sha256,
+      bytes: verified.manifest.payloads.replayEvidence.bytes,
+      manifest: verified.manifest,
+    };
+  }
+  throw new Error('Unsupported artifact');
+};
+
+export const listMcpArtifacts = async (userName: string) => {
+  const { deployments } = await readMcpDeployments(userName);
+  const allowed = new Set(deployments.map((row) => row.id));
+  const pending = [
+    'runtime-evidence',
+    'runtime-feedback',
+    `mcp/${mcpId(userName)}`,
+  ].map((dir) => ({ dir: path.join(dataRoot(), dir), depth: 0 }));
+  const items = [];
+  let visited = 0;
+  let invalidBundles = 0;
+  while (pending.length && visited < 2000 && items.length < 100) {
+    const current = pending.shift()!;
+    visited++;
+    let entries;
+    try {
+      entries = await readdir(current.dir, { withFileTypes: true });
+    } catch {
+      continue;
+    }
+    if (entries.some((entry) => entry.name === '.complete' && entry.isFile())) {
+      try {
+        const artifact = await verifyEntry(current.dir, userName, allowed);
+        await mcpStorage.put(storageKey(userName, artifact.id), artifact, 3600);
+        items.push({
+          id: artifact.id,
+          kind: artifact.kind,
+          deploymentId: artifact.deploymentId,
+          sha256: artifact.sha256,
+          bytes: artifact.bytes,
+          manifest: artifact.manifest,
+        });
+      } catch {
+        invalidBundles++;
+      }
+    }
+    if (current.depth < 12)
+      for (const entry of entries) {
+        if (entry.isDirectory() && !entry.isSymbolicLink())
+          pending.push({
+            dir: path.join(current.dir, entry.name),
+            depth: current.depth + 1,
+          });
+      }
+  }
+  return {
+    items,
+    observedAt: Date.now(),
+    source: 'verified_local_bundles',
+    truncated: pending.length > 0,
+    invalidOrInaccessibleBundles: invalidBundles,
+    note: 'Only verified, user-owned bundles available on this host are included.',
+  };
+};
+
+export const resolveMcpArtifact = async (userName: string, id: string) => {
+  if (!/^[a-f0-9]{64}$/.test(id)) throw new Error('Invalid artifact id');
+  const stored = await mcpStorage.get<CatalogEntry>(storageKey(userName, id));
+  if (!stored || stored.userName !== userName)
+    throw new Error('Artifact not found; refresh diagnostics_list_reports');
+  const { deployments } = await readMcpDeployments(userName);
+  const verified = await verifyEntry(
+    stored.bundleDir,
+    userName,
+    new Set(deployments.map((row) => row.id)),
+  );
+  if (verified.id !== id) throw new Error('Artifact changed since listing');
+  return verified;
+};
+
+export const readMcpArtifactChunk = async (
+  userName: string,
+  id: string,
+  offset: number,
+  length: number,
+) => {
+  const artifact = await resolveMcpArtifact(userName, id);
+  const handle = await open(await confinedPath(artifact.payloadPath), 'r');
+  try {
+    const buffer = Buffer.alloc(
+      Math.min(length, Math.max(0, artifact.bytes - offset)),
+    );
+    const { bytesRead } = await handle.read(buffer, 0, buffer.length, offset);
+    return {
+      id,
+      offset,
+      bytes: artifact.bytes,
+      sha256: artifact.sha256,
+      encoding: 'base64',
+      data: buffer.subarray(0, bytesRead).toString('base64'),
+      nextOffset:
+        offset + bytesRead < artifact.bytes ? offset + bytesRead : null,
+    };
+  } finally {
+    await handle.close();
+  }
+};
+
+export const readMcpDiagnosticReport = async (userName: string, id: string) => {
+  const artifact = await resolveMcpArtifact(userName, id);
+  const payload = JSON.parse(await readFile(artifact.payloadPath, 'utf8'));
+  // Large reports stay available through artifact_get with original checksums.
+  return {
+    id,
+    manifest: artifact.manifest,
+    bytes: artifact.bytes,
+    sha256: artifact.sha256,
+    ...(artifact.bytes <= 96000
+      ? { report: payload }
+      : {
+          summary: {
+            reportType: payload.reportType,
+            window: payload.window,
+            deployment: payload.deployment,
+            comparison: payload.comparison,
+            counts: payload.counts,
+          },
+          fullReport: 'Use artifact_get to read the complete original payload.',
+        }),
+  };
+};

package/src/app/lib/mcp/http.ts

@@ -0,0 +1,24 @@
+/** Bound allocations even when Content-Length is missing or untrusted. */
+export const readMcpBody = async (request: Request, limit: number) => {
+  if (Number(request.headers.get('content-length') || 0) > limit)
+    throw new Error('Request too large');
+  const reader = request.body?.getReader();
+  if (!reader) return '';
+  const chunks: Uint8Array[] = [];
+  let bytes = 0;
+  try {
+    for (;;) {
+      const { done, value } = await reader.read();
+      if (done) break;
+      bytes += value.byteLength;
+      if (bytes > limit) {
+        await reader.cancel();
+        throw new Error('Request too large');
+      }
+      chunks.push(value);
+    }
+    return Buffer.concat(chunks).toString('utf8');
+  } finally {
+    reader.releaseLock();
+  }
+};