@wardby/cli 0.6.0 → 0.8.0

package/dist/native-worker/gateway-server.js

@@ -10,14 +10,16 @@
  * session budget before the provider is called and settles at the provider's
  * reported usage; the worker's own usage numbers are never read.
  */
-import { logger } from "../core/logger.js";
-import { createNativeRunTools, durableDelegate, failNativeRun, finishNativeRun, nativeRunIntegrations, recordNativeRunProgress, runDrivability, sandboxCapabilityHash, } from "../core/runner.js";
+import { createNativeRunTools, durableDelegate, failNativeRun, finishNativeRun, nativeRunIntegrations, recordNativeRunProgress, runDrivability, sandboxCapabilityHash, userToolSecretValues, } from "../core/runner.js";
+import { ReviewReadLedger } from "../core/review-reads.js";
 import { DELEGATE_TOOL_PREFIX } from "../core/tool-names.js";
+import { relayedOutputTokens } from "../providers/coding-proxy/interrupted.js";
 import { RoutingLlmProvider } from "../providers/llm/routing.js";
 import { isPrivilegedBridgeName } from "../sandbox/host-functions.js";
+import { DEFAULT_TOOL_TIMEOUT_MS } from "../sandbox/tool-timeout.js";
+import { forWorker, gatewayLog } from "./gateway.js";
 import { PrismaGatewayLedger } from "./ledger.js";
 import { GatewayError, GatewayRequestSchema, parseParams, } from "./protocol.js";
-const serverLog = logger.child({ module: "native-gateway-server" });
 /** Output tokens reserved for a model call that names no maxTokens (as the coding proxy does). */
 export const GATEWAY_DEFAULT_RESERVE_OUTPUT_TOKENS = 4_096;
 /** The most output tokens one call may reserve for. */
@@ -29,10 +31,10 @@ const ok = (result) => ({
     status: 200,
     body: { ok: true, result: result ?? null },
 });
-const fail = (status, code, message) => ({
+const fail = (status, code, message, causeCode) => ({
     kind: "json",
     status,
-    body: { ok: false, error: { code, message } },
+    body: { ok: false, error: { code, message, ...(causeCode ? { causeCode } : {}) } },
 });
 const STATUS_FOR = {
     invalid_request: 400,
@@ -46,22 +48,53 @@ const STATUS_FOR = {
 };
 /** Serves one gateway request. Never throws: every failure is a response. */
 export async function serveGatewayRequest(deps, authorization, body) {
+    // The capability once parsed, then every secret value of the rebuilt run: what a cause code and
+    // the log line are checked against. Unset (no bearer), no cause code is sent.
+    const scope = {};
     try {
-        return await handle(deps, authorization, body);
+        return await handle(deps, authorization, body, scope);
     }
     catch (err) {
-        if (err instanceof GatewayError)
-            return fail(STATUS_FOR[err.code] ?? 500, err.code, err.message);
-        serverLog.error({ err }, "native gateway request failed");
-        return fail(500, "internal", "The gateway could not serve this call.");
+        return failureResponse(err, scope.secretValues);
     }
 }
-async function handle(deps, authorization, body) {
+/**
+ * Every secret value the rebuilt run can read (each user tool's readable or brokered values), and
+ * the request's own capability: what a cause code is checked against before it leaves the gateway.
+ */
+export function runSecretValues(ctx, capability) {
+    return async () => [
+        capability,
+        ...(await userToolSecretValues(ctx.tools, Object.keys(ctx.snapshot.input.userTools))),
+        ...(await ctx.tools.mcpSecretValues()),
+    ];
+}
+/**
+ * A failure as its response. Only a checked cause code leaves the gateway (workerGatewayError),
+ * never the rest of an unexpected error's message; the server's own log line is redacted by the
+ * same values.
+ */
+export async function failureResponse(err, secretValues) {
+    const sent = await forWorker(err, secretValues, "native gateway request failed");
+    return fail(STATUS_FOR[sent.code] ?? 500, sent.code, sent.message, sent.causeCode);
+}
+/** A model stream whose failure reaches the worker as the same checked error a JSON response carries. */
+export async function* checkedEvents(events, secretValues) {
+    try {
+        yield* events;
+    }
+    catch (err) {
+        throw await forWorker(err, secretValues, "native gateway model stream failed");
+    }
+}
+async function handle(deps, authorization, body, scope) {
     const { db } = deps;
     const ledger = new PrismaGatewayLedger(db);
     const token = /^Bearer (\S+)$/.exec(authorization ?? "")?.[1];
     if (!token)
         return fail(401, "unauthorized", "A gateway capability is required.");
+    // Until the run's tools are rebuilt, the capability is the secret value an error is checked against.
+    scope.secretValues = async () => [token];
     const session = await ledger.findSessionByCapabilityHash(sandboxCapabilityHash(token));
     if (!session)
         return fail(401, "unauthorized", "Unknown gateway capability.");
@@ -90,19 +123,20 @@ async function handle(deps, authorization, body) {
         throw new GatewayError("run_not_drivable", "This run is no longer running.");
     }
     const ctx = await rebuild(deps, session);
+    scope.secretValues = runSecretValues(ctx, token);
     switch (request.method) {
         case "llm.stream":
             return {
                 kind: "stream",
                 status: 200,
-                events: streamModel(ctx, ledger, request.callId, params),
+                events: checkedEvents(streamModel(ctx, ledger, request.callId, params), scope.secretValues),
             };
         case "llm.countTokens": {
             const p = params;
             return ok(await ctx.llm.countTokens(p.model, p.messages, p.tools));
         }
         case "builtin.call":
-            return ok(await builtin(ctx, ledger, request.callId, params, deps.pollWindowMs));
+            return ok(await builtin(ctx, ledger, request.callId, params, deps.pollWindowMs, scope.secretValues));
         case "host.call":
             return ok(await hostCall(ctx, ledger, request.callId, params));
         case "progress": {
@@ -130,10 +164,12 @@ async function rebuild(deps, session) {
     const llm = loaded.pricing && providers.llm instanceof RoutingLlmProvider
         ? providers.llm.forRun(loaded.pricing.entry)
         : providers.llm;
+    const reviewReads = ReviewReadLedger.fromJSON(session.reviewReads);
     return {
         session,
         snapshot,
         llm,
+        reviewReads,
         tools: createNativeRunTools({
             runId: session.runId,
             existingRun,
@@ -143,6 +179,8 @@ async function rebuild(deps, session) {
             reviewHosts,
             repoAccess,
             issueTrackers,
+            reviewReads,
+            deadlineAt: session.deadlineAt,
         }),
         finishContext: { runId: session.runId, db, providers, reviewHosts, repoAccess, issueTrackers },
         delegation: {
@@ -156,7 +194,8 @@ async function rebuild(deps, session) {
         },
     };
 }
-async function* streamModel(ctx, ledger, callId, params) {
+/** Exported for its unit test; the HTTP handler is its only production caller. */
+export async function* streamModel(ctx, ledger, callId, params) {
     const req = params.request;
     if (req.model !== ctx.snapshot.input.agent.model)
         throw new GatewayError("not_allowed", "A run may only call its own model.");
@@ -173,12 +212,22 @@ async function* streamModel(ctx, ledger, callId, params) {
     }
     let settled = false;
     let sawEvent = false;
+    // Set once the provider's response starts: it may bill hidden thinking or reasoning before any event.
+    let responseStarted = false;
+    // Generated output seen so far (text and tool calls), for an estimate if the stream is cut.
     let streamedText = "";
     try {
-        for await (const event of ctx.llm.stream(req)) {
+        const hooks = {
+            onResponseStarted: () => {
+                responseStarted = true;
+            },
+        };
+        for await (const event of ctx.llm.stream(req, undefined, hooks)) {
             sawEvent = true;
             if (event.type === "text")
                 streamedText += event.delta;
+            if (event.type === "tool_call")
+                streamedText += event.name + event.argsJson;
             if (event.type === "done") {
                 settled = true;
                 await ledger.complete(ctx.session.id, callId, {
@@ -194,9 +243,29 @@ async function* streamModel(ctx, ledger, callId, params) {
     }
     catch (err) {
         if (!settled) {
-            // Refused before anything streamed: the provider billed nothing. Mid-stream: unknown, keep the hold.
-            if (sawEvent)
-                await ledger.markUncertain(ctx.session.id, callId);
+            // Failed before the response started: the provider billed nothing. Once started: settle at an estimate.
+            if (sawEvent || responseStarted) {
+                // Bill the input and the output seen so far, never more than the hold. With no output seen
+                // (cut while thinking or reasoning), the run's median completed call, or none before the
+                // first one: as the coding proxy does. Estimating must never mask the stream error: on any
+                // failure, keep the full hold and rethrow the original.
+                try {
+                    const output = streamedText
+                        ? await streamedOutputTokens(ctx.llm, req.model, streamedText)
+                        : ((await ledger.medianOutputTokens(ctx.session.id)) ?? 0);
+                    const costUsd = Math.min(reservationUsd, ctx.llm.priceUsd(req.model, { inputTokens, outputTokens: output }));
+                    await ledger.markUncertain(ctx.session.id, callId, {
+                        inputTokens,
+                        outputTokens: output,
+                        cachedInputTokens: 0,
+                        cacheWriteTokens: 0,
+                        costUsd,
+                    });
+                }
+                catch {
+                    await ledger.markUncertain(ctx.session.id, callId).catch(() => undefined);
+                }
+            }
             else
                 await ledger.release(ctx.session.id, callId);
             settled = true;
@@ -206,9 +275,7 @@ async function* streamModel(ctx, ledger, callId, params) {
     finally {
         if (!settled) {
             // The worker stopped reading (its own budget cutoff) before usage arrived: bill an estimate.
-            const output = streamedText
-                ? await ctx.llm.countTokens(req.model, [{ role: "assistant", content: streamedText }]).catch(() => 0)
-                : 0;
+            const output = await streamedOutputTokens(ctx.llm, req.model, streamedText);
             await ledger.complete(ctx.session.id, callId, {
                 inputTokens,
                 outputTokens: output,
@@ -219,29 +286,67 @@ async function* streamModel(ctx, ledger, callId, params) {
         }
     }
 }
-async function builtin(ctx, ledger, callId, params, pollWindowMs) {
+/** Output tokens of a cut stream's output: counted, else the deliberately high bytes / 3 estimate. */
+async function streamedOutputTokens(llm, model, streamed) {
+    if (!streamed)
+        return 0;
+    return llm
+        .countTokens(model, [{ role: "assistant", content: streamed }])
+        .catch(() => relayedOutputTokens(Buffer.byteLength(streamed)));
+}
+/** The review tools that record reads (repo_publish_review checks them). */
+const REVIEW_READ_TOOLS = new Set(["repo_pr_read", "repo_read_file"]);
+async function builtin(ctx, ledger, callId, params, pollWindowMs, secretValues) {
     if (!ctx.snapshot.input.builtinTools.includes(params.name)) {
         throw new GatewayError("not_allowed", `"${params.name}" is not a built-in tool of this run.`);
     }
     if (params.name.startsWith(DELEGATE_TOOL_PREFIX)) {
-        const outcome = await durableDelegate({ ...ctx.delegation, pollWindowMs, ledger, sessionId: ctx.session.id }, callId, params.name, params.argsJson);
+        const outcome = await durableDelegate({ ...ctx.delegation, pollWindowMs, ledger, sessionId: ctx.session.id, secretValues }, callId, params.name, params.argsJson);
         return "pending" in outcome ? { pending: true } : outcome.result;
     }
     const handler = ctx.tools.builtinHandler(params.name);
     if (!handler)
         throw new GatewayError("not_allowed", `"${params.name}" is not a built-in tool of this run.`);
-    return replayable(ledger, ctx.session.id, callId, "builtin.call", () => handler(params.argsJson));
+    return replayable(ledger, ctx.session.id, callId, "builtin.call", async () => {
+        const result = await handler(params.argsJson);
+        // Each request rebuilds the tools, so what a read recorded is saved for the publish request's check.
+        if (REVIEW_READ_TOOLS.has(params.name))
+            await ledger.mergeReviewReads(ctx.session.id, ctx.reviewReads);
+        return result;
+    });
 }
-async function hostCall(ctx, ledger, callId, params) {
+/**
+ * Logged (at warn) in place of a user tool's console line when that tool's redaction list cannot
+ * be read: without the complete list the line cannot be shown to be free of its secret values, so
+ * none of it is logged. The tool's call still succeeds, as a console write does in-process.
+ */
+export const CONSOLE_WITHHELD_MESSAGE = "sandbox tool console line withheld: the tool's secret values could not be read";
+/** Serves one privileged bridge call for a worker (exported for tests). */
+export async function hostCall(ctx, ledger, callId, params) {
     if (!isPrivilegedBridgeName(params.bridge))
         throw new GatewayError("not_allowed", "unknown bridge");
     if (!ctx.snapshot.input.userTools[params.tool]) {
         throw new GatewayError("not_allowed", `"${params.tool}" is not a user tool of this run.`);
     }
-    const redact = params.bridge === "__bridge_console" ? await ctx.tools.readableSecretValues(params.tool) : undefined;
-    const host = ctx.tools.privilegedHostFor(params.tool, AbortSignal.timeout(30_000), redact);
-    if (!host)
+    let redact;
+    if (params.bridge === "__bridge_console") {
+        // Fail closed: a console line is redacted by the tool's complete list or not logged at all.
+        const values = await ctx.tools.readableSecretValues(params.tool).then((v) => v, () => undefined);
+        if (!values) {
+            gatewayLog.warn({ tool: params.tool }, CONSOLE_WITHHELD_MESSAGE);
+            return null;
+        }
+        redact = values;
+    }
+    // The tool's own limit plus a margin (30 s for a default tool), never past the run's deadline,
+    // and aborted if the run is stopped meanwhile.
+    const stop = ctx.tools.watchStop();
+    const signal = AbortSignal.any([AbortSignal.timeout(hostCallTimeoutMs(ctx, params.tool)), stop.signal]);
+    const host = ctx.tools.privilegedHostFor(params.tool, signal, redact);
+    if (!host) {
+        stop.done();
         throw new GatewayError("not_allowed", `"${params.tool}" is not a user tool of this run.`);
+    }
     const bridge = host[params.bridge];
     const run = async () => {
         try {
@@ -252,11 +357,23 @@ async function hostCall(ctx, ledger, callId, params) {
             throw new GatewayError("bridge_error", err instanceof Error ? err.message.slice(0, 1024) : "Host function failed.");
         }
     };
-    // Console lines are not worth a ledger row, and a secret value must never be stored in one
-    // (a secrets.get is a side-effect-free read, so a retried callId simply reads it again).
-    if (params.bridge === "__bridge_console" || params.bridge === "__bridge_secretsGet")
-        return run();
-    return replayable(ledger, ctx.session.id, callId, "host.call", run);
+    try {
+        // Console lines are not worth a ledger row, and a secret value must never be stored in one
+        // (a secrets.get is a side-effect-free read, so a retried callId simply reads it again).
+        if (params.bridge === "__bridge_console" || params.bridge === "__bridge_secretsGet")
+            return await run();
+        return await replayable(ledger, ctx.session.id, callId, "host.call", run);
+    }
+    finally {
+        stop.done();
+    }
+}
+/** Added to a tool's limit for one host call: the worker's own wall time ends the call first. */
+export const GATEWAY_HOST_CALL_MARGIN_MS = 20_000;
+/** How long one host call of `tool` may take: its limit plus the margin, cut to the run's deadline. */
+export function hostCallTimeoutMs(ctx, tool, now = Date.now()) {
+    const limitMs = (ctx.tools.toolTimeoutMs(tool) ?? DEFAULT_TOOL_TIMEOUT_MS) + GATEWAY_HOST_CALL_MARGIN_MS;
+    return Math.max(0, Math.min(limitMs, ctx.session.deadlineAt.getTime() - now));
 }
 /** Runs a one-shot call once per callId; a retry replays its recorded result. */
 async function replayable(ledger, sessionId, callId, method, run) {
@@ -284,7 +401,8 @@ async function replayable(ledger, sessionId, callId, method, run) {
         throw err;
     }
 }
-async function finish(ctx, ledger, callId, params) {
+/** The worker's terminal call: the run's one terminal write (masked by finishNativeRun), then the session ends. */
+export async function finish(ctx, ledger, callId, params) {
     const claimed = await ledger.claim(ctx.session.id, callId, "finish");
     if (claimed.outcome !== "claimed")
         return null;

package/dist/native-worker/gateway.d.ts

@@ -12,8 +12,29 @@
  */
 import type { EngineResult, EngineRunContext } from "../providers/engine/types.js";
 import type { LlmStreamEvent } from "../providers/llm/types.js";
+import pino from "pino";
 import { type PrivilegedHost } from "../sandbox/host-functions.js";
-import { type WorkerInput } from "./protocol.js";
+import { logger } from "../core/logger.js";
+import { GatewayError, type WorkerInput } from "./protocol.js";
+/**
+ * The gateways' log. Both (in-process and HTTP) log an unexpected error here, as `native gateway
+ * request failed` (or `native gateway model stream failed`). Exported so tests can watch it.
+ */
+export declare const gatewayLog: pino.Logger<never, boolean>;
+/**
+ * Logs an unexpected error for the operator, redacted by exact value. A successfully read list is
+ * complete (its reader rejects when any secret's read fails), so an empty one means the run has no
+ * secret values and the message is logged as is. Fail closed: a thrown value that is not an Error
+ * (a string, an object: its text cannot be redacted reliably), or no list (unavailable or
+ * unreadable), logs only the error's name and declared code, never its message, stack or content.
+ */
+export declare function logUnexpectedError(log: Pick<typeof logger, "error">, err: unknown, values: readonly string[] | undefined, logMessage: string, fields?: Record<string, unknown>): void;
+/**
+ * The one way either gateway turns a failure into what the worker sees: an unexpected error is
+ * logged for the operator (redacted by the run's secret values) and becomes the checked
+ * GatewayError (workerGatewayError); the values are read once and serve both.
+ */
+export declare function forWorker(err: unknown, secretValues: (() => Promise<Iterable<string>>) | undefined, logMessage: string): Promise<GatewayError>;
 /** The trusted gateway as a transport sees it: untrusted requests in, results or GatewayErrors out. */
 export interface NativeGateway {
     call(request: unknown): Promise<unknown>;
@@ -37,6 +58,13 @@ export interface SandboxedEngineOptions {
     ctx: Pick<EngineRunContext, "providers" | "onText" | "onProgress">;
     builtinHandler: (name: string) => ((argsJson: string) => Promise<string>) | undefined;
     privilegedHostFor: (tool: string, signal: AbortSignal) => PrivilegedHost | undefined;
+    /**
+     * Every secret value the user tool `tool` may read. A failure's cause code that overlaps any of
+     * the run's values is not sent to the worker; without this, no cause code is sent.
+     */
+    readableSecretValues?: (tool: string) => Promise<string[]>;
+    /** Every secret value of the run's attached MCP servers, checked the same way. */
+    mcpSecretValues?: () => Promise<string[]>;
     drivability: () => Promise<RunDrivability>;
     launcher: WorkerLauncher;
 }

package/dist/native-worker/gateway.js

@@ -10,10 +10,52 @@
  * refused once the run is no longer drivable; built-in tools and privileged
  * sandbox bridges are served only by name from the run's own surface.
  */
-import { isPrivilegedBridgeName } from "../sandbox/host-functions.js";
+import pino from "pino";
+import { isPrivilegedBridgeName, redactExactSecretValues, withEscapedForms, } from "../sandbox/host-functions.js";
 import { logger } from "../core/logger.js";
-import { GatewayError, GatewayRequestSchema, NATIVE_WORKER_PROTOCOL_VERSION, parseParams, ProtocolError, } from "./protocol.js";
-const gatewayLog = logger.child({ module: "native-gateway" });
+import { declaredCodeOf } from "../core/error-code.js";
+import { GatewayError, GatewayRequestSchema, NATIVE_WORKER_PROTOCOL_VERSION, parseParams, ProtocolError, workerGatewayError, } from "./protocol.js";
+/**
+ * The gateways' log. Both (in-process and HTTP) log an unexpected error here, as `native gateway
+ * request failed` (or `native gateway model stream failed`). Exported so tests can watch it.
+ */
+export const gatewayLog = logger.child({ module: "native-gateway" });
+/** `err` for the log with every exact secret value removed from its (cause-folded) message and stack. */
+function redactedError(err, rawValues) {
+    // The same expansion as the console bridge and the worker: a value may sit escaped in the text.
+    const values = withEscapedForms(rawValues);
+    // pino's own serializer folds the cause chain into message and stack, so a cause is covered too.
+    const serialized = pino.stdSerializers.err(err);
+    const safe = new Error(redactExactSecretValues(serialized.message, values));
+    safe.name = err.name;
+    safe.stack = redactExactSecretValues(serialized.stack ?? "", values);
+    return safe;
+}
+/**
+ * Logs an unexpected error for the operator, redacted by exact value. A successfully read list is
+ * complete (its reader rejects when any secret's read fails), so an empty one means the run has no
+ * secret values and the message is logged as is. Fail closed: a thrown value that is not an Error
+ * (a string, an object: its text cannot be redacted reliably), or no list (unavailable or
+ * unreadable), logs only the error's name and declared code, never its message, stack or content.
+ */
+export function logUnexpectedError(log, err, values, logMessage, fields = {}) {
+    if (values && err instanceof Error)
+        log.error({ ...fields, err: redactedError(err, values) }, logMessage);
+    else
+        log.error({ ...fields, errName: err instanceof Error ? err.name : typeof err, causeCode: declaredCodeOf(err) }, logMessage);
+}
+/**
+ * The one way either gateway turns a failure into what the worker sees: an unexpected error is
+ * logged for the operator (redacted by the run's secret values) and becomes the checked
+ * GatewayError (workerGatewayError); the values are read once and serve both.
+ */
+export async function forWorker(err, secretValues, logMessage) {
+    if (err instanceof GatewayError)
+        return workerGatewayError(err, secretValues);
+    const values = await secretValues?.().then((v) => [...v], () => undefined);
+    logUnexpectedError(gatewayLog, err, values, logMessage);
+    return workerGatewayError(err, values ? async () => values : undefined);
+}
 /** Thrown when the worker stopped because the run was cancelled; the runner records `cancelled`. */
 export class SandboxRunCancelledError extends Error {
 }
@@ -72,7 +114,16 @@ export async function runSandboxedEngine(options) {
             throw new GatewayError("duplicate_call", `callId "${callId}" was already used.`);
         usedCallIds.add(callId);
     };
-    const gateway = {
+    /** The run's readable secret values, for checking a failure's cause code before the worker sees it. */
+    const readable = options.readableSecretValues;
+    const mcpValues = options.mcpSecretValues;
+    const runSecretValues = readable
+        ? async () => [
+            ...(await Promise.all(Object.keys(input.userTools).map((tool) => readable(tool)))).flat(),
+            ...(mcpValues ? await mcpValues() : []),
+        ]
+        : undefined;
+    const served = {
         async *stream(raw) {
             const { request, params } = await admit(raw, "llm.stream");
             claim(request.callId);
@@ -178,6 +229,25 @@ export async function runSandboxedEngine(options) {
             }
         },
     };
+    // What crosses to the worker on every transport: a GatewayError, never an unexpected error's text.
+    const gateway = {
+        async call(raw) {
+            try {
+                return await served.call(raw);
+            }
+            catch (err) {
+                throw await forWorker(err, runSecretValues, "native gateway request failed");
+            }
+        },
+        async *stream(raw) {
+            try {
+                yield* served.stream(raw);
+            }
+            catch (err) {
+                throw await forWorker(err, runSecretValues, "native gateway model stream failed");
+            }
+        },
+    };
     const { exitCode } = await options.launcher.run(input, gateway, controller.signal);
     controller.abort();
     if (cancelled || (!finished && (await options.drivability()) === "cancelled")) {

package/dist/native-worker/http-server.d.ts

@@ -6,10 +6,16 @@
  *
  *   POST /native-gateway/v1/call   body: GatewayRequest
  *   → application/json            { ok: true, result } | { ok: false, error: { code, message } }
- *   → application/x-ndjson        (llm.stream) { event } … then { end: true } or { error }
+ *   → application/x-ndjson        (llm.stream) { event } … then { end: true } or { error: { code, message, causeCode? } }
+ *
+ *   POST /coding-mcp               a coding run's MCP calls, forwarded by the coding proxy's /mcp route
+ *                                  (src/core/coding-mcp.ts); its own auth: the run's MCP token, not a
+ *                                  gateway capability. 404 when the listener was started without it.
  */
 import { type Server } from "node:http";
 import { type GatewayServerDeps } from "./gateway-server.js";
+/** The HTTP listener's own log. Exported so tests can watch it. */
+export declare const httpLog: import("pino").Logger<never, boolean>;
 export declare const NATIVE_GATEWAY_PATH = "/native-gateway/v1/call";
 export interface NativeGatewayListen {
     host: string;

package/dist/native-worker/http-server.js

@@ -6,13 +6,21 @@
  *
  *   POST /native-gateway/v1/call   body: GatewayRequest
  *   → application/json            { ok: true, result } | { ok: false, error: { code, message } }
- *   → application/x-ndjson        (llm.stream) { event } … then { end: true } or { error }
+ *   → application/x-ndjson        (llm.stream) { event } … then { end: true } or { error: { code, message, causeCode? } }
+ *
+ *   POST /coding-mcp               a coding run's MCP calls, forwarded by the coding proxy's /mcp route
+ *                                  (src/core/coding-mcp.ts); its own auth: the run's MCP token, not a
+ *                                  gateway capability. 404 when the listener was started without it.
  */
 import { createServer } from "node:http";
+import { CODING_MCP_PATH, handleCodingMcpRequest } from "../core/coding-mcp.js";
 import { logger } from "../core/logger.js";
+import { HTTP_LIMITS, HttpBoundaryError, readBody as readLimitedBody } from "../mcp/transport/http-limits.js";
+import { logUnexpectedError } from "./gateway.js";
 import { serveGatewayRequest } from "./gateway-server.js";
-import { GatewayError, MAX_MESSAGE_BYTES } from "./protocol.js";
-const httpLog = logger.child({ module: "native-gateway-http" });
+import { GatewayError, MAX_MESSAGE_BYTES, toGatewayError } from "./protocol.js";
+/** The HTTP listener's own log. Exported so tests can watch it. */
+export const httpLog = logger.child({ module: "native-gateway-http" });
 export const NATIVE_GATEWAY_PATH = "/native-gateway/v1/call";
 /** Parses NATIVE_GATEWAY_LISTEN ("host:port" or ":port"); undefined when unset. */
 export function parseGatewayListen(value) {
@@ -56,6 +64,10 @@ export function createGatewayServer(deps) {
                 send(healthy ? 200 : 503, { ok: healthy });
                 return;
             }
+            if (new URL(req.url ?? "/", "http://gateway").pathname === CODING_MCP_PATH && deps.codingMcp) {
+                await serveCodingMcp(req, res, deps.codingMcp);
+                return;
+            }
             if (req.method !== "POST" || req.url !== NATIVE_GATEWAY_PATH) {
                 send(404, { ok: false, error: { code: "not_found", message: "not found" } });
                 return;
@@ -84,19 +96,62 @@ export function createGatewayServer(deps) {
                 res.end(`${JSON.stringify({ end: true })}\n`);
             }
             catch (err) {
-                const error = err instanceof GatewayError
-                    ? { code: err.code, message: err.message }
-                    : { code: "internal", message: err instanceof Error ? err.message : String(err) };
+                // The gateway's stream fails only with a checked GatewayError (checkedEvents); anything else
+                // still crosses as the generic message, never its own text.
+                const { code, message, causeCode } = toGatewayError(err);
+                const error = { code, message, ...(causeCode ? { causeCode } : {}) };
                 res.end(`${JSON.stringify({ error })}\n`);
             }
         })().catch((err) => {
-            httpLog.error({ err }, "native gateway HTTP handler failed");
+            // No run's secret values are known here, so only the name and declared code are logged.
+            logUnexpectedError(httpLog, err, undefined, "native gateway HTTP handler failed");
             if (!res.headersSent)
                 res.writeHead(500);
             res.end();
         });
     });
 }
+/** /coding-mcp: one JSON-RPC message per POST, answered as one JSON body (or 202 with none). */
+async function serveCodingMcp(req, res, deps) {
+    if (req.method !== "POST") {
+        res.setHeader("allow", "POST");
+        res.setHeader("content-type", "application/json");
+        res.writeHead(405);
+        res.end(JSON.stringify({ jsonrpc: "2.0", id: null, error: { code: -32600, message: "Use POST." } }));
+        return;
+    }
+    let body;
+    try {
+        body = await readLimitedBody(req, HTTP_LIMITS.json, AbortSignal.timeout(HTTP_LIMITS.requestMs));
+    }
+    catch (err) {
+        const status = err instanceof HttpBoundaryError ? err.status : 400;
+        res.setHeader("content-type", "application/json");
+        res.writeHead(status);
+        res.end(JSON.stringify({
+            jsonrpc: "2.0",
+            id: null,
+            error: { code: -32600, message: "The request body could not be read." },
+        }));
+        // A body left unread would otherwise keep the socket busy.
+        if (status === 413)
+            req.resume();
+        return;
+    }
+    // The proxy gives up on a call at its forward limit (or its worker goes away): the closed response
+    // aborts the call in flight rather than leave it running against the MCP server.
+    const closed = new AbortController();
+    res.on("close", () => {
+        if (!res.writableFinished)
+            closed.abort();
+    });
+    const response = await handleCodingMcpRequest(req.headers.authorization, body, deps, closed.signal);
+    if (closed.signal.aborted)
+        return;
+    res.setHeader("content-type", response.contentType);
+    res.writeHead(response.status);
+    res.end(response.body);
+}
 /** Starts the listener; resolves once it is accepting connections. */
 export async function startGatewayServer(listen, deps) {
     const server = createGatewayServer(deps);

package/dist/native-worker/http-transport.js

@@ -16,7 +16,7 @@ export function createHttpTransport(options) {
         headers: { "content-type": "application/json", authorization: `Bearer ${options.capability}` },
         body: JSON.stringify(request),
     });
-    const gatewayError = (error, status) => new GatewayError((error?.code ?? "internal"), error?.message ?? `gateway answered ${status}`);
+    const gatewayError = (error, status) => new GatewayError((error?.code ?? "internal"), error?.message ?? `gateway answered ${status}`, typeof error?.causeCode === "string" ? error.causeCode : undefined);
     return {
         async call(request) {
             const giveUpAt = Date.now() + retryForMs;

package/dist/native-worker/kubernetes-launcher.d.ts

@@ -14,8 +14,8 @@ import { type Power } from "../core/power.js";
 import { type KubernetesApi } from "../providers/jobs/kubernetes-api.js";
 import type { KubernetesPlatform } from "../providers/jobs/kubernetes-platform.js";
 import { type NativeWorkerLimits } from "./docker-isolation.js";
-import type { NativeWorkerState } from "./docker-launcher.js";
-import type { WorkerHandle } from "./launch.js";
+import { type NativeWorkerState } from "./docker-launcher.js";
+import { type WorkerHandle, type WorkerLaunchOptions } from "./launch.js";
 import type { WorkerInput } from "./protocol.js";
 import type { ManagedWorkerLauncher } from "./sandbox-executor.js";
 import { type WarmWorkerLauncher } from "./warm-pool.js";
@@ -48,6 +48,8 @@ export interface KubernetesNativeWorkerLauncherOptions {
     sleep?: (ms: number) => Promise<void>;
     /** Low-power mode: wakes the (possibly scaled-to-zero) native gateway before a launch. Default `DISABLED_POWER`. */
     power?: Power;
+    /** The bound on a failed worker's diagnostic (log and secret reads) before its exit is reported. Default WORKER_TAIL_TIMEOUT_MS. */
+    diagnosticTimeoutMs?: number;
 }
 /**
  * An object as the API server would store it, for comparison: keys sorted, and missing, undefined,
@@ -67,7 +69,9 @@ export declare class KubernetesNativeWorkerLauncher implements ManagedWorkerLaun
     private resolveGatewayHost;
     resolveGatewayUrl(): Promise<string>;
     private createIfMissing;
-    launch(input: WorkerInput): Promise<WorkerHandle>;
+    launch(input: WorkerInput, launchOptions?: WorkerLaunchOptions): Promise<WorkerHandle>;
+    /** A non-zero exit, with the tail of the worker's log (bounded and redacted: workerTailFields), as the Docker launcher logs it. */
+    private logFailedExit;
     /**
      * Policy first, so the pod never exists without it; then the pod; then attest and prove it. A
      * quota rejection becomes native_sandbox_capacity. Any failure removes what was made.