@wardby/cli 0.6.0 → 0.8.0

package/dist/providers/coding-proxy/registry/store.d.ts

@@ -1,10 +1,28 @@
 import type { PackageAllowlist } from "../../../coding/registry/allowlist.js";
+import type { AuditAdvisory, AuditRelation, PackageAuditMode, PackageAuditVerdict } from "../../../coding/registry/audit-mode.js";
 import type { DeclaredDependency, FileDependency } from "../../../coding/registry/types.js";
 export interface RegistryRunContext {
     runId: string;
     deadlineAt: Date;
     allowlist: PackageAllowlist;
     policy: unknown;
+    /** The run's repository (CodingRun.repository), a cache-key input. */
+    repository: string;
+    /** The image whose environment the install runs in: CodingRun.toolImage ?? workerImage; null when neither is recorded. */
+    cacheImage: string | null;
+    /** Whether the run's agent enabled the dependency cache, fixed at dispatch (CodingRun.dependencyCache). */
+    dependencyCache: boolean;
+    /** Package audit mode, fixed at dispatch (CodingRun.packageAuditMode); null = normal enforcement. */
+    packageAudit: PackageAuditMode | null;
+}
+/** A coding proxy session's dependency cache state (CodingProxySession). */
+export interface DependencyCacheSessionState {
+    /** Lockfile hashes this session's plans approved with no refusals, while unsealed. */
+    lockHashes: string[];
+    /** When the run's dependency step ended; after it the cache refuses the session. */
+    sealedAt: Date | null;
+    /** When the session was created: the upload window starts here. */
+    createdAt: Date;
 }
 export interface RegistryFetchRecord {
     runId: string;
@@ -31,6 +49,32 @@ export interface ApprovedVersion {
     name: string;
     version: string;
     integrity: string;
+    /** Blocking advisories the run's accepted set waived for this version,
+     *  when the plan kept it only by that waiver; absent or empty otherwise. */
+    acceptedAdvisories?: readonly string[];
+    /** Audit-mode plans only: why this approval is audited (outside the
+     *  allowlist, or kept past advisories in full mode). Absent = a normal approval. */
+    audit?: PackageAuditVerdict;
+}
+/** What a download of a plan-approved version needs. */
+export interface ApprovedDownload {
+    integrity: string;
+    downloadUrl: string;
+    /** Advisories the approval waived (empty when none). */
+    acceptedAdvisories: string[];
+    /** The approval's audit verdict; absent for a normal approval. */
+    audit?: PackageAuditVerdict;
+}
+/** One RegistryAuditRecord: a version a run's registry served only because of package audit mode. */
+export interface RegistryAuditInsert {
+    runId: string;
+    ecosystem: string;
+    name: string;
+    version: string;
+    relation: AuditRelation;
+    via?: string;
+    sizeBytes?: number;
+    advisories: readonly AuditAdvisory[];
 }
 /** One exact version a lockfile plan definitively refused for a run. */
 export interface PlanRefusedVersion {
@@ -52,13 +96,25 @@ export interface PlanRefusedVersion {
 export declare function extraAllowanceName(name: string, extra: string): string;
 /** The extra in an allowance row name for `name`, or null when the row is not one of its extras. */
 export declare function extraOfAllowanceName(rowName: string, name: string): string | null;
+/** The `auditedVia` of an audited allowance whose relation a lockfile plan
+ *  could not tell (`unknown`): no package name is empty. */
+export declare const AUDITED_VIA_UNKNOWN = "";
 /** Run-scoped store over the registry-only token session lookup and the
  *  RegistryAllowance/RegistryFetch tables (Task 5). Backs the registry proxy:
  *  it never sees the model capability, only the derived registry token. */
 export interface RegistryStore {
     findRunByRegistryTokenHash(hash: string, now: Date): Promise<RegistryRunContext | null>;
     isAllowedDependency(runId: string, ecosystem: string, name: string): Promise<boolean>;
+    /** The run's allowance of `name` (null = none): `auditedVia` is the audited package that declared it,
+     *  AUDITED_VIA_UNKNOWN when no one is known to, or null. */
+    findAllowance(runId: string, ecosystem: string, name: string): Promise<{
+        auditedVia: string | null;
+    } | null>;
     addAllowances(runId: string, ecosystem: string, names: readonly string[]): Promise<void>;
+    /** Like addAllowances, each name tagged with the audited package that declared it; existing rows are kept. */
+    addAuditedAllowances(runId: string, ecosystem: string, names: readonly string[], auditedVia: string): Promise<void>;
+    /** Insert-only; a row for the same run/ecosystem/name/version already present is kept. */
+    recordAudit(record: RegistryAuditInsert): Promise<void>;
     /** The extras the run allows for `name` (normalized, sorted). */
     allowedExtras(runId: string, ecosystem: string, name: string): Promise<string[]>;
     /** Records extras the run allows for each package (an existing one is kept). */
@@ -73,6 +129,10 @@ export interface RegistryStore {
     listFetches(runId: string): Promise<(RegistryFetchRecord & {
         createdAt: Date;
     })[]>;
+    /** The run's refused rows recorded at or after `since`, newest first, at most `limit`. */
+    listRecentRefusals(runId: string, since: Date, limit: number): Promise<(RegistryFetchRecord & {
+        createdAt: Date;
+    })[]>;
     /** Stored facts for these versions (any not stored are absent). */
     getVersionFacts(ecosystem: string, versions: readonly {
         name: string;
@@ -83,11 +143,9 @@ export interface RegistryStore {
     /** Approves exact versions for the run (an existing approval is kept). */
     approveVersions(runId: string, ecosystem: string, versions: readonly ApprovedVersion[]): Promise<void>;
     /** The run's approval of this exact version, with its download URL (from
-     *  the version's fact), or null. */
-    findApprovedVersion(runId: string, ecosystem: string, name: string, version: string): Promise<{
-        integrity: string;
-        downloadUrl: string;
-    } | null>;
+     *  the version's fact) and any advisories it was approved by waiving, or
+     *  null. */
+    findApprovedVersion(runId: string, ecosystem: string, name: string, version: string): Promise<ApprovedDownload | null>;
     /** Stores the run's plan refusals (an existing one is kept). */
     refusePlanVersions(runId: string, ecosystem: string, versions: readonly PlanRefusedVersion[]): Promise<void>;
     /** The run's plan refusal of this exact version, or null. */
@@ -96,12 +154,21 @@ export interface RegistryStore {
         reason: string;
         publishedAt: Date | null;
     } | null>;
+    /** Adds a lockfile hash to the run's session, atomically and only while
+     *  the session is unsealed, does not already hold it, and holds fewer
+     *  than `max`; otherwise does nothing. */
+    recordDependencyCacheLockHash(runId: string, lockHash: string, max: number): Promise<void>;
 }
 /** In-memory adapter for tests. `contexts` is settable directly so tests can
  *  seed a run without going through a full proxy session. */
 export declare class MemoryRegistryStore implements RegistryStore {
     readonly contexts: Map<string, RegistryRunContext>;
     readonly allowances: Set<string>;
+    /** `runId\0ecosystem\0name` -> the audited package that declared the allowance (first writer). */
+    readonly auditedVia: Map<string, string>;
+    readonly audits: (RegistryAuditInsert & {
+        createdAt: Date;
+    })[];
     readonly fetches: (RegistryFetchRecord & {
         createdAt: Date;
     })[];
@@ -111,9 +178,16 @@ export declare class MemoryRegistryStore implements RegistryStore {
     readonly approvals: Map<string, ApprovedVersion>;
     /** `runId\0ecosystem\0name\0version` -> plan refusal. */
     readonly planRefusals: Map<string, PlanRefusedVersion>;
+    /** runId -> dependency cache session state (shareable with the cache's memory store). */
+    readonly cacheSessions: Map<string, DependencyCacheSessionState>;
     findRunByRegistryTokenHash(hash: string, now: Date): Promise<RegistryRunContext | null>;
     isAllowedDependency(runId: string, ecosystem: string, name: string): Promise<boolean>;
+    findAllowance(runId: string, ecosystem: string, name: string): Promise<{
+        auditedVia: string | null;
+    } | null>;
     addAllowances(runId: string, ecosystem: string, names: readonly string[]): Promise<void>;
+    addAuditedAllowances(runId: string, ecosystem: string, names: readonly string[], auditedVia: string): Promise<void>;
+    recordAudit(record: RegistryAuditInsert): Promise<void>;
     allowedExtras(runId: string, ecosystem: string, name: string): Promise<string[]>;
     addExtraAllowances(runId: string, ecosystem: string, dependencies: readonly FileDependency[]): Promise<void>;
     recordFetch(record: RegistryFetchRecord): Promise<void>;
@@ -125,20 +199,21 @@ export declare class MemoryRegistryStore implements RegistryStore {
     listFetches(runId: string): Promise<(RegistryFetchRecord & {
         createdAt: Date;
     })[]>;
+    listRecentRefusals(runId: string, since: Date, limit: number): Promise<(RegistryFetchRecord & {
+        createdAt: Date;
+    })[]>;
     getVersionFacts(ecosystem: string, versions: readonly {
         name: string;
         version: string;
     }[]): Promise<StoredVersionFact[]>;
     putVersionFacts(ecosystem: string, facts: readonly StoredVersionFact[]): Promise<void>;
     approveVersions(runId: string, ecosystem: string, versions: readonly ApprovedVersion[]): Promise<void>;
-    findApprovedVersion(runId: string, ecosystem: string, name: string, version: string): Promise<{
-        integrity: string;
-        downloadUrl: string;
-    } | null>;
+    findApprovedVersion(runId: string, ecosystem: string, name: string, version: string): Promise<ApprovedDownload | null>;
     refusePlanVersions(runId: string, ecosystem: string, versions: readonly PlanRefusedVersion[]): Promise<void>;
     findPlanRefusal(runId: string, ecosystem: string, name: string, version: string): Promise<{
         code: string;
         reason: string;
         publishedAt: Date | null;
     } | null>;
+    recordDependencyCacheLockHash(runId: string, lockHash: string, max: number): Promise<void>;
 }

package/dist/providers/coding-proxy/registry/store.js

@@ -17,11 +17,17 @@ export function extraOfAllowanceName(rowName, name) {
     const extra = rowName.slice(prefix.length, -1);
     return /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/.test(extra) ? extra : null;
 }
+/** The `auditedVia` of an audited allowance whose relation a lockfile plan
+ *  could not tell (`unknown`): no package name is empty. */
+export const AUDITED_VIA_UNKNOWN = "";
 /** In-memory adapter for tests. `contexts` is settable directly so tests can
  *  seed a run without going through a full proxy session. */
 export class MemoryRegistryStore {
     contexts = new Map();
     allowances = new Set();
+    /** `runId\0ecosystem\0name` -> the audited package that declared the allowance (first writer). */
+    auditedVia = new Map();
+    audits = [];
     fetches = [];
     /** `ecosystem\0name\0version` -> fact. */
     facts = new Map();
@@ -29,6 +35,8 @@ export class MemoryRegistryStore {
     approvals = new Map();
     /** `runId\0ecosystem\0name\0version` -> plan refusal. */
     planRefusals = new Map();
+    /** runId -> dependency cache session state (shareable with the cache's memory store). */
+    cacheSessions = new Map();
     async findRunByRegistryTokenHash(hash, now) {
         const context = this.contexts.get(hash);
         return context && context.deadlineAt > now ? context : null;
@@ -39,10 +47,32 @@ export class MemoryRegistryStore {
             return false;
         return this.allowances.has(`${runId}\0${ecosystem}\0${name}`);
     }
+    async findAllowance(runId, ecosystem, name) {
+        if (!(await this.isAllowedDependency(runId, ecosystem, name)))
+            return null;
+        return { auditedVia: this.auditedVia.get(`${runId}\0${ecosystem}\0${name}`) ?? null };
+    }
     async addAllowances(runId, ecosystem, names) {
         for (const name of names)
             this.allowances.add(`${runId}\0${ecosystem}\0${name}`);
     }
+    async addAuditedAllowances(runId, ecosystem, names, auditedVia) {
+        for (const name of names) {
+            const key = `${runId}\0${ecosystem}\0${name}`;
+            if (this.allowances.has(key))
+                continue;
+            this.allowances.add(key);
+            this.auditedVia.set(key, auditedVia);
+        }
+    }
+    async recordAudit(record) {
+        const same = (row) => row.runId === record.runId &&
+            row.ecosystem === record.ecosystem &&
+            row.name === record.name &&
+            row.version === record.version;
+        if (!this.audits.some(same))
+            this.audits.push({ ...record, createdAt: new Date() });
+    }
     async allowedExtras(runId, ecosystem, name) {
         const prefix = `${runId}\0${ecosystem}\0`;
         return [...this.allowances]
@@ -67,6 +97,12 @@ export class MemoryRegistryStore {
     async listFetches(runId) {
         return this.fetches.filter((fetch) => fetch.runId === runId);
     }
+    async listRecentRefusals(runId, since, limit) {
+        return this.fetches
+            .filter((fetch) => fetch.runId === runId && fetch.outcome === "refused" && fetch.createdAt >= since)
+            .reverse()
+            .slice(0, limit);
+    }
     async getVersionFacts(ecosystem, versions) {
         return versions.flatMap(({ name, version }) => this.facts.get(`${ecosystem}\0${name}\0${version}`) ?? []);
     }
@@ -87,7 +123,14 @@ export class MemoryRegistryStore {
     async findApprovedVersion(runId, ecosystem, name, version) {
         const approval = this.approvals.get(`${runId}\0${ecosystem}\0${name}\0${version}`);
         const fact = this.facts.get(`${ecosystem}\0${name}\0${version}`);
-        return approval && fact ? { integrity: approval.integrity, downloadUrl: fact.downloadUrl } : null;
+        return approval && fact
+            ? {
+                integrity: approval.integrity,
+                downloadUrl: fact.downloadUrl,
+                acceptedAdvisories: [...(approval.acceptedAdvisories ?? [])],
+                ...(approval.audit ? { audit: approval.audit } : {}),
+            }
+            : null;
     }
     async refusePlanVersions(runId, ecosystem, versions) {
         for (const refusal of versions) {
@@ -100,4 +143,14 @@ export class MemoryRegistryStore {
         const refusal = this.planRefusals.get(`${runId}\0${ecosystem}\0${name}\0${version}`);
         return refusal ? { code: refusal.code, reason: refusal.reason, publishedAt: refusal.publishedAt ?? null } : null;
     }
+    async recordDependencyCacheLockHash(runId, lockHash, max) {
+        let session = this.cacheSessions.get(runId);
+        if (!session) {
+            session = { lockHashes: [], sealedAt: null, createdAt: new Date() };
+            this.cacheSessions.set(runId, session);
+        }
+        if (session.sealedAt || session.lockHashes.includes(lockHash) || session.lockHashes.length >= max)
+            return;
+        session.lockHashes.push(lockHash);
+    }
 }

package/dist/providers/coding-proxy/runtime.d.ts

@@ -1,5 +1,7 @@
 import type { PrismaClient } from "#prisma";
 import type { UpstreamFetch } from "../../coding/registry/types.js";
+import { type BlobStoreConfig } from "../storage/index.js";
+import type { BlobStore } from "../storage/types.js";
 import { startDenyPortListener } from "./deny-port.js";
 import { type PinnedProxyFetchOptions } from "./secure-fetch.js";
 import { startCodingProxyServer, type CodingProxyServerHandle } from "./server.js";
@@ -12,6 +14,12 @@ import type { ProxyAuditSink } from "./types.js";
  *  JSON). Exported so its header-mapping can be unit-tested directly,
  *  without needing a live upstream. */
 export declare function createRegistryUpstream(pinned: typeof globalThis.fetch): UpstreamFetch;
+/**
+ * WARDBY_MCP_GATEWAY_URL: the native gateway's base URL, which the /mcp route forwards to (its
+ * /coding-mcp route). Unset or empty: /mcp answers 503 mcp_unavailable. Anything but an http(s) URL
+ * without credentials, query or fragment stops start-up (the value is not echoed).
+ */
+export declare function loadMcpGatewayUrl(env: NodeJS.ProcessEnv): string | undefined;
 export interface CodingProxyRuntimeOptions {
     db: PrismaClient;
     /** The package registry's own client, so its traffic (many concurrent
@@ -25,6 +33,8 @@ export interface CodingProxyRuntimeOptions {
      *  upstream hosts are actually passed to the pinned-fetch allowlist. */
     createPinnedFetch?: (options: PinnedProxyFetchOptions) => typeof globalThis.fetch;
     audit?: ProxyAuditSink;
+    /** Overridable for tests: builds the dependency cache's blob store. */
+    createBlobStore?: (config: BlobStoreConfig) => BlobStore;
     onRequest?: (event: {
         protocol: "openai-responses" | "anthropic-messages" | "other";
         status: number;

package/dist/providers/coding-proxy/runtime.js

@@ -1,8 +1,16 @@
+import { loadDependencyCacheConfig } from "../../config/dependency-cache.js";
+import { createSimulatorModelFetch, createSimulatorRegistryFetch, startupTestSimulators, } from "../../config/test-simulators.js";
 import { logger } from "../../core/logger.js";
 import { REGISTRY_ADAPTERS } from "../../coding/registry/adapters.js";
 import { CODING_PROXY_ALIAS, CODING_PROXY_DENY_PORT, CODING_PROXY_PORT } from "../jobs/docker-isolation.js";
+import { createBlobStore } from "../storage/index.js";
+import { startEviction } from "./dependency-cache/eviction.js";
+import { PrismaDependencyCacheStore } from "./dependency-cache/prisma-store.js";
+import { ModelRequestSeal } from "./dependency-cache/model-request-seal.js";
+import { DependencyCacheService } from "./dependency-cache/service.js";
 import { startDenyPortListener } from "./deny-port.js";
 import { EnvironmentCredentialResolver } from "./environment-credentials.js";
+import { createMcpRoute } from "./mcp-route.js";
 import { createMockUpstream, mockUpstreamFromEnv } from "./mock-upstream.js";
 import { CodingProxy } from "./proxy.js";
 import { PrismaProxyLedger } from "./prisma-ledger.js";
@@ -10,7 +18,7 @@ import { OsvAudit } from "./registry/audit.js";
 import { PrismaRegistryStore } from "./registry/prisma-store.js";
 import { DEFAULT_PLAN_MAX_ENTRIES, DEFAULT_PLAN_TIMEOUT_MS } from "./registry/plan.js";
 import { DEFAULT_GRAPH_TIMEOUT_MS, DEFAULT_MAX_GRAPH_PACKAGES, DEFAULT_PLAN_MAX_PER_RUN, RegistryService, } from "./registry/service.js";
-import { createPinnedProxyFetch } from "./secure-fetch.js";
+import { createPinnedProxyFetch, PROXY_EGRESS_ERROR } from "./secure-fetch.js";
 import { startCodingProxyServer } from "./server.js";
 const MIB = 1024 * 1024;
 function positiveInt(value, fallback) {
@@ -37,9 +45,37 @@ export function createRegistryUpstream(pinned) {
         },
     });
 }
+/**
+ * WARDBY_MCP_GATEWAY_URL: the native gateway's base URL, which the /mcp route forwards to (its
+ * /coding-mcp route). Unset or empty: /mcp answers 503 mcp_unavailable. Anything but an http(s) URL
+ * without credentials, query or fragment stops start-up (the value is not echoed).
+ */
+export function loadMcpGatewayUrl(env) {
+    const value = env.WARDBY_MCP_GATEWAY_URL?.trim();
+    if (!value)
+        return undefined;
+    let url;
+    try {
+        url = new URL(value);
+    }
+    catch {
+        url = undefined;
+    }
+    if (!url ||
+        (url.protocol !== "http:" && url.protocol !== "https:") ||
+        url.username ||
+        url.password ||
+        url.search ||
+        url.hash) {
+        throw new Error("WARDBY_MCP_GATEWAY_URL must be an http(s) URL without credentials, query or fragment");
+    }
+    return url.href.replace(/\/+$/, "");
+}
 /** Starts the trusted proxy with the fixed worker-only Docker endpoint, plus the deny port the enforcement witness probes. */
 export async function startConfiguredCodingProxy(options) {
     const env = options.env ?? process.env;
+    // Throws on an invalid setting, before anything listens.
+    const cacheConfig = loadDependencyCacheConfig(env);
     // Throws (mock_upstream_guard) on a partial or malformed setting, before anything listens.
     const mock = mockUpstreamFromEnv(env);
     if (mock) {
@@ -48,21 +84,24 @@ export async function startConfiguredCodingProxy(options) {
     const audit = mock
         ? (event) => options.audit?.({ ...event, mockUpstream: true })
         : options.audit;
-    const proxy = new CodingProxy({
-        ledger: new PrismaProxyLedger(options.db),
-        credentials: new EnvironmentCredentialResolver(env),
-        audit,
-        ...(mock ? { fetch: createMockUpstream(mock) } : {}),
-    });
+    // Throws on an invalid setting, before anything listens.
+    const mcpGatewayUrl = loadMcpGatewayUrl(env);
+    // Throws (test_simulators_refused) on any refusal, before anything listens.
+    const simulators = startupTestSimulators("coding-proxy", env);
     const buildPinnedFetch = options.createPinnedFetch ?? createPinnedProxyFetch;
     const upstreamHosts = [...new Set([...REGISTRY_ADAPTERS.values()].flatMap((adapter) => adapter.upstreamHosts))];
-    const pinned = buildPinnedFetch({ allowedHosts: [...upstreamHosts, "api.osv.dev"] });
+    // WARDBY_TEST_SIMULATORS (test only): the registry hosts go to their simulators, and every
+    // other host is still refused.
+    const pinned = simulators
+        ? createSimulatorRegistryFetch(simulators, () => new Error(PROXY_EGRESS_ERROR))
+        : buildPinnedFetch({ allowedHosts: [...upstreamHosts, "api.osv.dev"] });
     const upstream = createRegistryUpstream(pinned);
     const metadataTimeoutMs = positiveInt(env.REGISTRY_METADATA_TIMEOUT_MS, 30_000);
     const maxMetadataBytes = positiveInt(env.REGISTRY_MAX_METADATA_MB, 64) * MIB;
+    const registryStore = new PrismaRegistryStore(options.registryDb ?? options.db);
     const registry = new RegistryService({
         adapters: REGISTRY_ADAPTERS,
-        store: new PrismaRegistryStore(options.registryDb ?? options.db),
+        store: registryStore,
         audit: new OsvAudit({
             fetch: upstream,
             failOpen: env.REGISTRY_AUDIT_FAIL_OPEN === "true",
@@ -85,14 +124,66 @@ export async function startConfiguredCodingProxy(options) {
             idleTimeoutMs: positiveInt(env.REGISTRY_IDLE_TIMEOUT_MS, 120_000),
         },
     });
-    const startServer = options.startServer ?? startCodingProxyServer;
-    const server = await startServer(proxy, {
-        host: "0.0.0.0",
-        port: CODING_PROXY_PORT,
-        expectedHost: `${CODING_PROXY_ALIAS}:${CODING_PROXY_PORT}`,
-        registry,
-        onRequest: options.onRequest,
+    let dependencyCache;
+    let modelRequestSeal;
+    let eviction;
+    if (cacheConfig.enabled) {
+        const blobs = (options.createBlobStore ?? createBlobStore)(cacheConfig.blobStore);
+        const cacheStore = new PrismaDependencyCacheStore(options.registryDb ?? options.db);
+        modelRequestSeal = new ModelRequestSeal(cacheStore);
+        dependencyCache = new DependencyCacheService({
+            registry: registryStore,
+            store: cacheStore,
+            blobs,
+            maxSnapshotBytes: cacheConfig.maxSnapshotBytes,
+            uploadMs: cacheConfig.uploadMs,
+        });
+        eviction = startEviction({
+            store: cacheStore,
+            blobs,
+            limits: {
+                maxAgeMs: cacheConfig.maxAgeMs,
+                repoCapBytes: cacheConfig.repoCapBytes,
+                totalCapBytes: cacheConfig.totalCapBytes,
+            },
+        });
+    }
+    else if (cacheConfig.reason === "no_blob_store") {
+        logger.warn({ module: "coding-proxy-runtime", event: "proxy.dependency_cache_no_blob_store" }, "coding proxy: WARDBY_DEPENDENCY_CACHE=true but no BLOB_STORE is configured; the dependency cache is off");
+    }
+    const seal = modelRequestSeal;
+    const ledger = new PrismaProxyLedger(options.db);
+    const proxy = new CodingProxy({
+        ledger,
+        credentials: new EnvironmentCredentialResolver(env),
+        audit,
+        // WARDBY_TEST_SIMULATORS (test only; refused alongside the mock upstream): the scripted model,
+        // with every credential header dropped.
+        ...(simulators
+            ? { fetch: createSimulatorModelFetch(simulators, () => new Error(PROXY_EGRESS_ERROR)) }
+            : mock
+                ? { fetch: createMockUpstream(mock) }
+                : {}),
+        // The run's first model request closes its dependency cache (no-op for a run with it off).
+        ...(seal ? { onModelRequest: (runId) => seal.onModelRequest(runId) } : {}),
     });
+    const startServer = options.startServer ?? startCodingProxyServer;
+    let server;
+    try {
+        server = await startServer(proxy, {
+            host: "0.0.0.0",
+            port: CODING_PROXY_PORT,
+            expectedHost: `${CODING_PROXY_ALIAS}:${CODING_PROXY_PORT}`,
+            registry,
+            ...(dependencyCache ? { dependencyCache } : {}),
+            mcp: createMcpRoute({ ledger, gatewayUrl: mcpGatewayUrl }),
+            onRequest: options.onRequest,
+        });
+    }
+    catch (error) {
+        eviction?.stop();
+        throw error;
+    }
     let deny;
     try {
         deny = await (options.startDenyPort ?? startDenyPortListener)("0.0.0.0", CODING_PROXY_DENY_PORT);
@@ -100,12 +191,14 @@ export async function startConfiguredCodingProxy(options) {
     catch (error) {
         // A proxy without its witness must not stay up: the launcher's gate would never be able to
         // prove a policy is enforced, and every launch would fail at the gate instead of at startup.
+        eviction?.stop();
         await server.close();
         throw error;
     }
     return {
         port: server.port,
         close: async () => {
+            eviction?.stop();
             await deny.close();
             await server.close();
         },

package/dist/providers/coding-proxy/server.d.ts

@@ -1,6 +1,8 @@
+import { type IncomingMessage, type ServerResponse } from "node:http";
 import type { ProxyAuditEvent } from "./types.js";
 import { type CodingProxy } from "./proxy.js";
 import { type RegistryService } from "./registry/service.js";
+import type { DependencyCacheService } from "./dependency-cache/service.js";
 import type { ProxyProtocol } from "./types.js";
 declare const proxyLog: import("pino").Logger<never, boolean>;
 /**
@@ -13,7 +15,13 @@ export interface CodingProxyServerConfig {
     host: string;
     port: number;
     expectedHost?: string;
-    registry?: Pick<RegistryService, "handle"> & Partial<Pick<RegistryService, "plan">>;
+    registry?: Pick<RegistryService, "handle"> & Partial<Pick<RegistryService, "plan" | "refusals">>;
+    /** The dependency cache (`/cache/...`); absent when the deployment has it off. */
+    dependencyCache?: Pick<DependencyCacheService, "handle" | "uploadMs">;
+    /** Time to receive a whole request (default HTTP_LIMITS.requestMs); a cache upload gets its upload window instead. */
+    requestMs?: number;
+    /** The worker's MCP route (`/mcp`, createMcpRoute); absent, /mcp is not found. */
+    mcp?: (request: IncomingMessage, response: ServerResponse) => Promise<void>;
     onRequest?: (event: {
         protocol: ProxyProtocol | "other";
         status: number;

package/dist/providers/coding-proxy/server.js

@@ -6,6 +6,7 @@ import { logger } from "../../core/logger.js";
 import { CodingProxyError, PROXY_MAX_BODY_BYTES } from "./proxy.js";
 import { RegistryError } from "../../coding/registry/types.js";
 import { MAX_PLAN_BODY_BYTES } from "./registry/service.js";
+import { MCP_ROUTE_PATH } from "./mcp-route.js";
 const proxyLog = logger.child({ module: "coding-proxy" });
 /**
  * Writes a proxy audit event to the operator log. The events carry ids,
@@ -99,6 +100,12 @@ function readPlanBody(request, signal) {
             failed();
     });
 }
+/** An error answer to a request whose body was not read: close the
+ *  connection rather than read (or keep) what the client is still sending. */
+function closeIfBodyUnread(request, response) {
+    if (!request.complete && !response.headersSent)
+        response.setHeader("connection", "close");
+}
 function routeProtocol(method, url) {
     if (method !== "POST")
         return undefined;
@@ -130,8 +137,25 @@ function responseSink(response) {
     };
 }
 export async function startCodingProxyServer(proxy, config) {
+    const requestMs = config.requestMs ?? HTTP_LIMITS.requestMs;
+    // A snapshot upload (up to WARDBY_DEPENDENCY_CACHE_MAX_SNAPSHOT_MB) cannot
+    // arrive within requestMs, and Node's requestTimeout is server-wide: with
+    // the cache on it is widened to cover the upload window (which the cache
+    // enforces on the upload itself), and every request gets a requestMs timer
+    // of its own. Only the cache lifts that timer, and only for an upload it
+    // has authenticated, found eligible and given its upload slot.
+    const extendedRequests = config.dependencyCache !== undefined;
     const server = createServer({ maxHeaderSize: 16 * 1024, requireHostHeader: true }, (request, response) => {
         const startedAt = performance.now();
+        const bodyTimer = extendedRequests
+            ? setTimeout(() => {
+                if (!request.complete)
+                    request.socket.destroy();
+            }, requestMs).unref()
+            : undefined;
+        // Done with once the response is over (finished or closed early).
+        if (bodyTimer)
+            response.once("close", () => clearTimeout(bodyTimer));
         const protocol = routeProtocol(request.method, request.url) ?? "other";
         response.once("finish", () => {
             try {
@@ -143,9 +167,19 @@ export async function startCodingProxyServer(proxy, config) {
         });
         void (async () => {
             if (config.expectedHost && request.headers.host !== config.expectedHost) {
+                closeIfBodyUnread(request, response);
                 sendError(response, 403, "invalid_host");
                 return;
             }
+            if (request.url?.startsWith("/cache/")) {
+                if (!config.dependencyCache) {
+                    closeIfBodyUnread(request, response);
+                    sendError(response, 404, "not_found");
+                    return;
+                }
+                await config.dependencyCache.handle(request, response, registryToken(request.headers.authorization), () => clearTimeout(bodyTimer));
+                return;
+            }
             if (request.url?.startsWith("/registry/")) {
                 if (!config.registry) {
                     sendError(response, 404, "not_found");
@@ -187,6 +221,16 @@ export async function startCodingProxyServer(proxy, config) {
                     sendError(response, 405, "method_not_allowed");
                     return;
                 }
+                // The run's recent refusals, for clients that don't print the 403 body (pip, uv).
+                const refusals = request.url.match(/^\/registry\/-\/refusals(?:\?(.*))?$/);
+                if (refusals && config.registry.refusals) {
+                    const since = new URLSearchParams(refusals[1] ?? "").get("since");
+                    sendRegistry(response, await config.registry.refusals({
+                        token: registryToken(request.headers.authorization),
+                        ...(since ? { since: new Date(since) } : {}),
+                    }));
+                    return;
+                }
                 const match = request.url.match(/^\/registry\/([a-z0-9-]+)\/(.*)$/);
                 if (!match) {
                     sendError(response, 404, "not_found");
@@ -223,6 +267,15 @@ export async function startCodingProxyServer(proxy, config) {
                 });
                 return;
             }
+            if (request.url === MCP_ROUTE_PATH || request.url?.startsWith(`${MCP_ROUTE_PATH}?`)) {
+                if (!config.mcp) {
+                    closeIfBodyUnread(request, response);
+                    sendError(response, 404, "not_found");
+                    return;
+                }
+                await config.mcp(request, response);
+                return;
+            }
             if (request.method === "HEAD" && request.url === "/api/hello") {
                 response.writeHead(200, { "cache-control": "no-store" }).end();
                 return;
@@ -269,6 +322,7 @@ export async function startCodingProxyServer(proxy, config) {
                     response.destroy();
                 return;
             }
+            closeIfBodyUnread(request, response);
             if (error instanceof CodingProxyError || error instanceof HttpBoundaryError) {
                 proxyLog.info({ event: "request.rejected", code: error instanceof CodingProxyError ? error.code : error.message }, "coding proxy request rejected");
                 sendError(response, error.status, error instanceof CodingProxyError ? error.code : error.message);
@@ -283,7 +337,7 @@ export async function startCodingProxyServer(proxy, config) {
             sendError(response, 500, "internal_error");
         });
     });
-    server.requestTimeout = HTTP_LIMITS.requestMs;
+    server.requestTimeout = extendedRequests ? requestMs + config.dependencyCache.uploadMs : requestMs;
     server.headersTimeout = HTTP_LIMITS.headersMs;
     server.keepAliveTimeout = 5_000;
     server.maxRequestsPerSocket = 100;