@wardby/cli 0.7.0 → 0.8.0

package/dist/mcp/tools/trigger.js

@@ -29,6 +29,7 @@
  * gets 404, not another principal's final text/cost.
  */
 import { dispatchRun } from "../../core/dispatch.js";
+import { RepositoryChoiceRefusedError, resolveCodingRepository } from "../../core/coding-repository.js";
 import { AttributionError, explicitAttribution, RESPONSE_PATH_SNAPSHOT_BUDGET, } from "../../core/attribution.js";
 import { CodingBaseRefSchema, CodingTaskOverrideSchema, isLocalRepository } from "../../coding/protocol.js";
 import { loadLocalRepoRoots, resolveLocalRepository, LocalRepoError } from "../../coding/local-repo.js";
@@ -46,6 +47,7 @@ const TriggerAgentSchema = z
     agentId: z.string().trim().min(1).max(128),
     task: CodingTaskOverrideSchema.optional(),
     baseRef: CodingBaseRefSchema.optional(),
+    repository: z.string().min(1).max(300).optional(),
     issue: z.unknown().optional(),
     review: z
         .object({
@@ -127,10 +129,10 @@ function assertOverrideAllowed(principalId, agent, args) {
     // Strictly the owner: the stdio operator's owner-level access doesn't make
     // it the owner whose repository authority the task steers (review M8).
     const isOwner = agent.ownerId !== null && agent.ownerId === principalId;
-    if (isOwner || (args.task === undefined && args.baseRef === undefined))
+    if (isOwner || (args.task === undefined && args.baseRef === undefined && args.repository === undefined))
         return;
     if (!agent.codingProfile?.allowWebhookTaskOverride) {
-        throw new McpError(403, `Agent "${agent.id}": only its owner can pass a task or baseRef, unless the owner allows it (codingProfile.allowWebhookTaskOverride).`);
+        throw new McpError(403, `Agent "${agent.id}": only its owner can pass a task, baseRef or repository, unless the owner allows it (codingProfile.allowWebhookTaskOverride).`);
     }
 }
 /** execute on the agent, plus the override rule; `db` is the transaction when re-checking. */
@@ -150,6 +152,10 @@ export function registerTriggerTool(mcp) {
                 agentId: { type: "string" },
                 task: { type: "string" },
                 baseRef: { type: "string" },
+                repository: {
+                    type: "string",
+                    description: "Coding agents only: a repository on the agent's list (see get_agent). Omit to use codingProfile.repository.",
+                },
                 review: {
                     type: "object",
                     additionalProperties: false,
@@ -189,13 +195,28 @@ export function registerTriggerTool(mcp) {
                 }
                 review = await resolveLocalReview(ctx, agent.id, args.review);
             }
-            if (agent.kind !== "coding" && (args.task !== undefined || args.baseRef !== undefined)) {
-                throw new McpError(400, "Task and baseRef overrides are only valid for coding agents.");
+            if (agent.kind !== "coding" &&
+                (args.task !== undefined || args.baseRef !== undefined || args.repository !== undefined)) {
+                throw new McpError(400, "Task, baseRef and repository overrides are only valid for coding agents.");
             }
             // A local repository is re-checked against the roots as they are now
             // (they can narrow after the agent was saved), before any run exists.
             let warnings = [];
-            const repository = agent.kind === "coding" ? agent.codingProfile?.repository : undefined;
+            // The resolver's refusal lists the agent's repositories, so it runs only
+            // after requireTriggerable (execute on the agent) and never echoes the
+            // requested value.
+            const refused = (err) => {
+                if (err instanceof RepositoryChoiceRefusedError)
+                    throw new McpError(400, `${err.code}: ${err.message}`);
+                throw err;
+            };
+            const repository = agent.kind === "coding" && agent.codingProfile
+                ? (await resolveCodingRepository(ctx.db, {
+                    agentId: agent.id,
+                    profile: agent.codingProfile,
+                    requested: args.repository,
+                }).catch(refused)).repository
+                : undefined;
             if (repository !== undefined && isLocalRepository(repository)) {
                 try {
                     const resolved = await resolveLocalRepository(repository, loadLocalRepoRoots(process.env).roots);
@@ -238,6 +259,7 @@ export function registerTriggerTool(mcp) {
                     trigger: "manual",
                     codingTask: args.task,
                     codingBaseRef: args.baseRef,
+                    codingRepository: args.repository,
                     attribution,
                     task: ctx.clientSupportsTasks ? { principalId: ctx.principal.id, ttlMs: DEFAULT_TASK_TTL_MS } : undefined,
                     triggeredById: ctx.principal.id,
@@ -262,7 +284,7 @@ export function registerTriggerTool(mcp) {
             catch (err) {
                 if (pullRequest)
                     await ctx.db.localPullRequest.deleteMany({ where: { id: pullRequest.id } }).catch(() => { });
-                throw err;
+                return refused(err);
             }
             if (ctx.clientSupportsTasks) {
                 if (!dispatched.task)

package/dist/mcp/transport/http-limits.d.ts

@@ -14,4 +14,6 @@ export declare class PayloadTooLargeError extends HttpBoundaryError {
 }
 export declare function canonicalUrl(value: string): URL;
 export declare function readBody(req: IncomingMessage, maxBytes: number, signal: AbortSignal): Promise<string>;
+/** readBody's bytes, undecoded (for a route that forwards the body unchanged). */
+export declare function readBodyBytes(req: IncomingMessage, maxBytes: number, signal: AbortSignal): Promise<Buffer>;
 export declare function parseBody(raw: string, contentType: string | undefined): unknown;

package/dist/mcp/transport/http-limits.js

@@ -23,7 +23,11 @@ export function canonicalUrl(value) {
     }
     return url;
 }
-export function readBody(req, maxBytes, signal) {
+export async function readBody(req, maxBytes, signal) {
+    return (await readBodyBytes(req, maxBytes, signal)).toString("utf8");
+}
+/** readBody's bytes, undecoded (for a route that forwards the body unchanged). */
+export function readBodyBytes(req, maxBytes, signal) {
     const length = req.headers["content-length"];
     if (length && (!/^\d+$/.test(length) || Number(length) > maxBytes))
         return Promise.reject(new PayloadTooLargeError());
@@ -55,7 +59,7 @@ export function readBody(req, maxBytes, signal) {
         };
         const end = () => {
             clean();
-            resolve(Buffer.concat(chunks, size).toString("utf8"));
+            resolve(Buffer.concat(chunks, size));
         };
         req.on("data", data);
         req.once("end", end);

package/dist/mcp/webhooks/ingress.js

@@ -18,11 +18,19 @@ export async function handleWebhookIngress(webhookId, req, db, executor, issueTr
     if (req.body.task !== undefined && codingTask === undefined) {
         return { status: 400, body: { error: "invalid_task" } };
     }
+    // `wardbyRepository`, not `repository`, for the same reason: a forwarded GitHub
+    // payload carries its own top-level `repository` object.
+    const repository = req.body.wardbyRepository;
+    if (repository !== undefined &&
+        (typeof repository !== "string" || repository.length === 0 || repository.length > 300)) {
+        return { status: 400, body: { error: "invalid_repository" } };
+    }
     // `wardbyIssue`, not `issue`: forwarded third-party payloads (GitHub, Jira)
     // carry their own top-level `issue` object, which is not ours to read.
     const result = await resolveWebhookRun(webhookId, secret, db, executor, codingTask, {
         issue: req.body.wardbyIssue,
         issueTrackers,
+        repository,
     });
     if (result.ok) {
         return { status: 202, body: { runId: result.runId } };
@@ -30,6 +38,8 @@ export async function handleWebhookIngress(webhookId, req, db, executor, issueTr
     switch (result.reason) {
         case "invalid_issue":
             return { status: 400, body: { error: "invalid_issue", error_description: result.message } };
+        case "invalid_repository":
+            return { status: 400, body: { error: "invalid_repository" } };
         case "not_found":
             return { status: 404, body: { error: "not_found" } };
         case "invalid_secret":

package/dist/native-worker/gateway-server.d.ts

@@ -11,6 +11,7 @@
  * reported usage; the worker's own usage numbers are never read.
  */
 import { createNativeRunTools, durableDelegate, type NativeRunFinishContext, type NativeRunProviders, type RunnerDb, type SandboxSessionSnapshot } from "../core/runner.js";
+import type { CodingMcpDeps } from "../core/coding-mcp.js";
 import { ReviewReadLedger } from "../core/review-reads.js";
 import type { LlmProvider, LlmStreamEvent } from "../providers/llm/types.js";
 import { PrismaGatewayLedger, type GatewaySessionRecord } from "./ledger.js";
@@ -26,6 +27,8 @@ export interface GatewayServerDeps {
     providers: NativeRunProviders;
     /** Delegation long-poll window; tests shorten it. */
     pollWindowMs?: number;
+    /** Serves POST /coding-mcp on the same listener (remote MCP servers for coding runs); unset → 404. */
+    codingMcp?: CodingMcpDeps;
 }
 /** What a request gets back: one JSON value, or a stream of model events. */
 export type GatewayResponse = {
@@ -72,6 +75,17 @@ export declare function streamModel(ctx: RebuiltRun, ledger: PrismaGatewayLedger
 export declare const CONSOLE_WITHHELD_MESSAGE = "sandbox tool console line withheld: the tool's secret values could not be read";
 /** Serves one privileged bridge call for a worker (exported for tests). */
 export declare function hostCall(ctx: RebuiltRun, ledger: PrismaGatewayLedger, callId: string, params: GatewayParams<"host.call">): Promise<unknown>;
+/** Added to a tool's limit for one host call: the worker's own wall time ends the call first. */
+export declare const GATEWAY_HOST_CALL_MARGIN_MS = 20000;
+/** How long one host call of `tool` may take: its limit plus the margin, cut to the run's deadline. */
+export declare function hostCallTimeoutMs(ctx: {
+    session: {
+        deadlineAt: Date;
+    };
+    tools: {
+        toolTimeoutMs: (name: string) => number | undefined;
+    };
+}, tool: string, now?: number): number;
 /** The worker's terminal call: the run's one terminal write (masked by finishNativeRun), then the session ends. */
 export declare function finish(ctx: RebuiltRun, ledger: PrismaGatewayLedger, callId: string, params: GatewayParams<"finish">): Promise<null>;
 export {};

package/dist/native-worker/gateway-server.js

@@ -16,6 +16,7 @@ import { DELEGATE_TOOL_PREFIX } from "../core/tool-names.js";
 import { relayedOutputTokens } from "../providers/coding-proxy/interrupted.js";
 import { RoutingLlmProvider } from "../providers/llm/routing.js";
 import { isPrivilegedBridgeName } from "../sandbox/host-functions.js";
+import { DEFAULT_TOOL_TIMEOUT_MS } from "../sandbox/tool-timeout.js";
 import { forWorker, gatewayLog } from "./gateway.js";
 import { PrismaGatewayLedger } from "./ledger.js";
 import { GatewayError, GatewayRequestSchema, parseParams, } from "./protocol.js";
@@ -65,6 +66,7 @@ export function runSecretValues(ctx, capability) {
     return async () => [
         capability,
         ...(await userToolSecretValues(ctx.tools, Object.keys(ctx.snapshot.input.userTools))),
+        ...(await ctx.tools.mcpSecretValues()),
     ];
 }
 /**
@@ -178,6 +180,7 @@ async function rebuild(deps, session) {
             repoAccess,
             issueTrackers,
             reviewReads,
+            deadlineAt: session.deadlineAt,
         }),
         finishContext: { runId: session.runId, db, providers, reviewHosts, repoAccess, issueTrackers },
         delegation: {
@@ -335,9 +338,15 @@ export async function hostCall(ctx, ledger, callId, params) {
         }
         redact = values;
     }
-    const host = ctx.tools.privilegedHostFor(params.tool, AbortSignal.timeout(30_000), redact);
-    if (!host)
+    // The tool's own limit plus a margin (30 s for a default tool), never past the run's deadline,
+    // and aborted if the run is stopped meanwhile.
+    const stop = ctx.tools.watchStop();
+    const signal = AbortSignal.any([AbortSignal.timeout(hostCallTimeoutMs(ctx, params.tool)), stop.signal]);
+    const host = ctx.tools.privilegedHostFor(params.tool, signal, redact);
+    if (!host) {
+        stop.done();
         throw new GatewayError("not_allowed", `"${params.tool}" is not a user tool of this run.`);
+    }
     const bridge = host[params.bridge];
     const run = async () => {
         try {
@@ -348,11 +357,23 @@ export async function hostCall(ctx, ledger, callId, params) {
             throw new GatewayError("bridge_error", err instanceof Error ? err.message.slice(0, 1024) : "Host function failed.");
         }
     };
-    // Console lines are not worth a ledger row, and a secret value must never be stored in one
-    // (a secrets.get is a side-effect-free read, so a retried callId simply reads it again).
-    if (params.bridge === "__bridge_console" || params.bridge === "__bridge_secretsGet")
-        return run();
-    return replayable(ledger, ctx.session.id, callId, "host.call", run);
+    try {
+        // Console lines are not worth a ledger row, and a secret value must never be stored in one
+        // (a secrets.get is a side-effect-free read, so a retried callId simply reads it again).
+        if (params.bridge === "__bridge_console" || params.bridge === "__bridge_secretsGet")
+            return await run();
+        return await replayable(ledger, ctx.session.id, callId, "host.call", run);
+    }
+    finally {
+        stop.done();
+    }
+}
+/** Added to a tool's limit for one host call: the worker's own wall time ends the call first. */
+export const GATEWAY_HOST_CALL_MARGIN_MS = 20_000;
+/** How long one host call of `tool` may take: its limit plus the margin, cut to the run's deadline. */
+export function hostCallTimeoutMs(ctx, tool, now = Date.now()) {
+    const limitMs = (ctx.tools.toolTimeoutMs(tool) ?? DEFAULT_TOOL_TIMEOUT_MS) + GATEWAY_HOST_CALL_MARGIN_MS;
+    return Math.max(0, Math.min(limitMs, ctx.session.deadlineAt.getTime() - now));
 }
 /** Runs a one-shot call once per callId; a retry replays its recorded result. */
 async function replayable(ledger, sessionId, callId, method, run) {

package/dist/native-worker/gateway.d.ts

@@ -63,6 +63,8 @@ export interface SandboxedEngineOptions {
      * the run's values is not sent to the worker; without this, no cause code is sent.
      */
     readableSecretValues?: (tool: string) => Promise<string[]>;
+    /** Every secret value of the run's attached MCP servers, checked the same way. */
+    mcpSecretValues?: () => Promise<string[]>;
     drivability: () => Promise<RunDrivability>;
     launcher: WorkerLauncher;
 }

package/dist/native-worker/gateway.js

@@ -116,8 +116,12 @@ export async function runSandboxedEngine(options) {
     };
     /** The run's readable secret values, for checking a failure's cause code before the worker sees it. */
     const readable = options.readableSecretValues;
+    const mcpValues = options.mcpSecretValues;
     const runSecretValues = readable
-        ? async () => (await Promise.all(Object.keys(input.userTools).map((tool) => readable(tool)))).flat()
+        ? async () => [
+            ...(await Promise.all(Object.keys(input.userTools).map((tool) => readable(tool)))).flat(),
+            ...(mcpValues ? await mcpValues() : []),
+        ]
         : undefined;
     const served = {
         async *stream(raw) {

package/dist/native-worker/http-server.d.ts

@@ -7,6 +7,10 @@
  *   POST /native-gateway/v1/call   body: GatewayRequest
  *   → application/json            { ok: true, result } | { ok: false, error: { code, message } }
  *   → application/x-ndjson        (llm.stream) { event } … then { end: true } or { error: { code, message, causeCode? } }
+ *
+ *   POST /coding-mcp               a coding run's MCP calls, forwarded by the coding proxy's /mcp route
+ *                                  (src/core/coding-mcp.ts); its own auth: the run's MCP token, not a
+ *                                  gateway capability. 404 when the listener was started without it.
  */
 import { type Server } from "node:http";
 import { type GatewayServerDeps } from "./gateway-server.js";

package/dist/native-worker/http-server.js

@@ -7,9 +7,15 @@
  *   POST /native-gateway/v1/call   body: GatewayRequest
  *   → application/json            { ok: true, result } | { ok: false, error: { code, message } }
  *   → application/x-ndjson        (llm.stream) { event } … then { end: true } or { error: { code, message, causeCode? } }
+ *
+ *   POST /coding-mcp               a coding run's MCP calls, forwarded by the coding proxy's /mcp route
+ *                                  (src/core/coding-mcp.ts); its own auth: the run's MCP token, not a
+ *                                  gateway capability. 404 when the listener was started without it.
  */
 import { createServer } from "node:http";
+import { CODING_MCP_PATH, handleCodingMcpRequest } from "../core/coding-mcp.js";
 import { logger } from "../core/logger.js";
+import { HTTP_LIMITS, HttpBoundaryError, readBody as readLimitedBody } from "../mcp/transport/http-limits.js";
 import { logUnexpectedError } from "./gateway.js";
 import { serveGatewayRequest } from "./gateway-server.js";
 import { GatewayError, MAX_MESSAGE_BYTES, toGatewayError } from "./protocol.js";
@@ -58,6 +64,10 @@ export function createGatewayServer(deps) {
                 send(healthy ? 200 : 503, { ok: healthy });
                 return;
             }
+            if (new URL(req.url ?? "/", "http://gateway").pathname === CODING_MCP_PATH && deps.codingMcp) {
+                await serveCodingMcp(req, res, deps.codingMcp);
+                return;
+            }
             if (req.method !== "POST" || req.url !== NATIVE_GATEWAY_PATH) {
                 send(404, { ok: false, error: { code: "not_found", message: "not found" } });
                 return;
@@ -101,6 +111,47 @@ export function createGatewayServer(deps) {
         });
     });
 }
+/** /coding-mcp: one JSON-RPC message per POST, answered as one JSON body (or 202 with none). */
+async function serveCodingMcp(req, res, deps) {
+    if (req.method !== "POST") {
+        res.setHeader("allow", "POST");
+        res.setHeader("content-type", "application/json");
+        res.writeHead(405);
+        res.end(JSON.stringify({ jsonrpc: "2.0", id: null, error: { code: -32600, message: "Use POST." } }));
+        return;
+    }
+    let body;
+    try {
+        body = await readLimitedBody(req, HTTP_LIMITS.json, AbortSignal.timeout(HTTP_LIMITS.requestMs));
+    }
+    catch (err) {
+        const status = err instanceof HttpBoundaryError ? err.status : 400;
+        res.setHeader("content-type", "application/json");
+        res.writeHead(status);
+        res.end(JSON.stringify({
+            jsonrpc: "2.0",
+            id: null,
+            error: { code: -32600, message: "The request body could not be read." },
+        }));
+        // A body left unread would otherwise keep the socket busy.
+        if (status === 413)
+            req.resume();
+        return;
+    }
+    // The proxy gives up on a call at its forward limit (or its worker goes away): the closed response
+    // aborts the call in flight rather than leave it running against the MCP server.
+    const closed = new AbortController();
+    res.on("close", () => {
+        if (!res.writableFinished)
+            closed.abort();
+    });
+    const response = await handleCodingMcpRequest(req.headers.authorization, body, deps, closed.signal);
+    if (closed.signal.aborted)
+        return;
+    res.setHeader("content-type", response.contentType);
+    res.writeHead(response.status);
+    res.end(response.body);
+}
 /** Starts the listener; resolves once it is accepting connections. */
 export async function startGatewayServer(listen, deps) {
     const server = createGatewayServer(deps);

package/dist/native-worker/ledger.d.ts

@@ -115,11 +115,15 @@ export declare class PrismaGatewayLedger {
     setDelegation(sessionId: string, callId: string, state: {
         status: "pending" | "waiting_budget";
         childAgentId: string;
+        childRepository?: string;
         childRunId?: string;
     }): Promise<void>;
     delegation(sessionId: string, callId: string): Promise<DelegationState | null>;
-    /** The sub-agents other delegations of this run are waiting for budget to start. */
-    waitingChildAgentIds(sessionId: string, exceptCallId: string): Promise<string[]>;
+    /** The sub-agents (and repositories, null = the child's default) other delegations of this run wait on budget to start. */
+    waitingDelegations(sessionId: string, exceptCallId: string): Promise<{
+        childAgentId: string;
+        childRepository: string | null;
+    }[]>;
     /** Delegations of this session whose child run is started and not yet reported. */
     openDelegationChildren(sessionId: string): Promise<string[]>;
 }

package/dist/native-worker/ledger.js

@@ -202,6 +202,7 @@ export class PrismaGatewayLedger {
             data: {
                 status: state.status,
                 childAgentId: state.childAgentId,
+                ...(state.childRepository ? { childRepository: state.childRepository } : {}),
                 ...(state.childRunId ? { childRunId: state.childRunId } : {}),
             },
         });
@@ -213,13 +214,13 @@ export class PrismaGatewayLedger {
         const status = row.status === "waiting_budget" ? "waiting_budget" : row.status === "completed" ? "completed" : "pending";
         return { status, childRunId: row.childRunId, childAgentId: row.childAgentId, createdAt: row.createdAt };
     }
-    /** The sub-agents other delegations of this run are waiting for budget to start. */
-    async waitingChildAgentIds(sessionId, exceptCallId) {
+    /** The sub-agents (and repositories, null = the child's default) other delegations of this run wait on budget to start. */
+    async waitingDelegations(sessionId, exceptCallId) {
         const rows = await this.db.nativeGatewayCall.findMany({
             where: { sessionId, status: "waiting_budget", callId: { not: exceptCallId }, childAgentId: { not: null } },
-            select: { childAgentId: true },
+            select: { childAgentId: true, childRepository: true },
         });
-        return rows.map((row) => row.childAgentId);
+        return rows.map((row) => ({ childAgentId: row.childAgentId, childRepository: row.childRepository }));
     }
     /** Delegations of this session whose child run is started and not yet reported. */
     async openDelegationChildren(sessionId) {

package/dist/native-worker/protocol.d.ts

@@ -145,6 +145,7 @@ export declare const WorkerInputSchema: z.ZodObject<{
     userTools: z.ZodRecord<z.ZodString, z.ZodObject<{
         code: z.ZodString;
         paramsZod: z.ZodString;
+        timeoutMs: z.ZodOptional<z.ZodNumber>;
     }, z.core.$strict>>;
     runsConcurrently: z.ZodArray<z.ZodString>;
     pricing: z.ZodObject<{

package/dist/native-worker/protocol.js

@@ -125,7 +125,10 @@ const LoadedToolSchema = z
     .object({ name: z.string(), description: z.string(), jsonSchema: z.record(z.string(), z.unknown()) })
     .strict();
 /** A user tool as the worker runs it: code and schema only. Capabilities stay on the gateway. */
-const WorkerUserToolSchema = z.object({ code: z.string(), paramsZod: z.string() }).strict();
+/** `timeoutMs`: the tool's time limit for this run, already capped by the server; absent = the default. */
+const WorkerUserToolSchema = z
+    .object({ code: z.string(), paramsZod: z.string(), timeoutMs: z.number().int().positive().optional() })
+    .strict();
 const PricingSchema = z
     .object({
     provider: z.string(),

package/dist/providers/coding-proxy/capability-hash.d.ts

@@ -0,0 +1,2 @@
+/** SHA-256 (base64url) of a run credential: the proxy stores only this, never the value. */
+export declare function capabilityHash(capability: string): string;

package/dist/providers/coding-proxy/capability-hash.js

@@ -0,0 +1,5 @@
+import { createHash } from "node:crypto";
+/** SHA-256 (base64url) of a run credential: the proxy stores only this, never the value. */
+export function capabilityHash(capability) {
+    return createHash("sha256").update(capability).digest("base64url");
+}

package/dist/providers/coding-proxy/mcp-route.d.ts

@@ -0,0 +1,34 @@
+/**
+ * The coding proxy's /mcp route (remote MCP servers, phase 2): the worker's MCP server URL. It
+ * checks the run's MCP token (`rmt_…`, WARDBY_MCP_TOKEN in the worker) against the proxy session,
+ * then forwards the JSON-RPC body unchanged, with the same Authorization, to the native gateway's
+ * /coding-mcp route (WARDBY_MCP_GATEWAY_URL), which checks the token again and runs the call. The
+ * proxy never sees an MCP server URL or secret; the gateway redacts results before they get here.
+ *
+ * Secrets: the token is only hashed and forwarded, never logged or echoed. The route's log line
+ * carries the session id, a sanitized JSON-RPC method, the status and a fixed reason code only:
+ * never the body, the token or an error's text. Every body this route writes is fixed text or the
+ * gateway's answer, unchanged.
+ */
+import type { IncomingMessage, ServerResponse } from "node:http";
+import type { ProxyLedger } from "./types.js";
+export declare const MCP_ROUTE_PATH = "/mcp";
+/** The longest a forwarded call may take, when the session's deadline is later. */
+export declare const MCP_FORWARD_MAX_MS: number;
+export declare const MCP_UNAVAILABLE_MESSAGE = "MCP tools aren't available on this server.";
+/**
+ * A JSON-RPC method as the log may carry it: its first 64 characters when they are letters, `/`
+ * and `_` only, else "other". Anything that starts like an MCP token is "other" too.
+ */
+export declare function mcpLogMethod(value: unknown): string;
+export interface McpRouteOptions {
+    ledger: Pick<ProxyLedger, "findSessionByMcpTokenHash">;
+    /** The native gateway's base URL; without one, /mcp answers 503 mcp_unavailable. */
+    gatewayUrl: string | undefined;
+    fetchImpl?: typeof fetch;
+    now?: () => Date;
+    log?: {
+        info(fields: Record<string, unknown>, message: string): void;
+    };
+}
+export declare function createMcpRoute(options: McpRouteOptions): (req: IncomingMessage, res: ServerResponse) => Promise<void>;

package/dist/providers/coding-proxy/mcp-route.js

@@ -0,0 +1,166 @@
+import { isMcpToken, mcpTokenHash, MCP_TOKEN_REQUIRED_MESSAGE } from "../../coding/mcp-token.js";
+import { logger } from "../../core/logger.js";
+import { HTTP_LIMITS, HttpBoundaryError, readBodyBytes } from "../../mcp/transport/http-limits.js";
+export const MCP_ROUTE_PATH = "/mcp";
+/** The gateway's route this one forwards to. */
+const GATEWAY_PATH = "/coding-mcp";
+/** The longest a forwarded call may take, when the session's deadline is later. */
+export const MCP_FORWARD_MAX_MS = 5 * 60_000;
+/** The largest gateway answer relayed (a tool result is text the model reads; same as a model request). */
+const MAX_GATEWAY_RESPONSE_BYTES = 8 * 1024 * 1024;
+export const MCP_UNAVAILABLE_MESSAGE = "MCP tools aren't available on this server.";
+const MCP_UNREACHABLE_MESSAGE = "MCP tools can't be reached right now.";
+const LOG_METHOD = /^[A-Za-z/_]+$/;
+/**
+ * A JSON-RPC method as the log may carry it: its first 64 characters when they are letters, `/`
+ * and `_` only, else "other". Anything that starts like an MCP token is "other" too.
+ */
+export function mcpLogMethod(value) {
+    if (typeof value !== "string")
+        return "other";
+    const method = value.slice(0, 64);
+    return LOG_METHOD.test(method) && !method.includes("rmt_") ? method : "other";
+}
+function methodOf(body) {
+    try {
+        const message = JSON.parse(body.toString("utf8"));
+        return mcpLogMethod(message?.method);
+    }
+    catch {
+        return "other";
+    }
+}
+class GatewayError extends Error {
+    reason;
+    constructor(reason) {
+        super(reason);
+        this.reason = reason;
+    }
+}
+const JSON_HEADERS = { "content-type": "application/json", "cache-control": "no-store" };
+const rpcError = (code, message) => JSON.stringify({ jsonrpc: "2.0", id: null, error: { code, message } });
+async function readGatewayBody(response) {
+    const chunks = [];
+    let size = 0;
+    if (!response.body)
+        return Buffer.alloc(0);
+    for await (const chunk of response.body) {
+        size += chunk.byteLength;
+        if (size > MAX_GATEWAY_RESPONSE_BYTES) {
+            void response.body.cancel().catch(() => undefined);
+            throw new GatewayError("gateway_response_too_large");
+        }
+        chunks.push(Buffer.from(chunk));
+    }
+    return Buffer.concat(chunks, size);
+}
+export function createMcpRoute(options) {
+    const fetchImpl = options.fetchImpl ?? fetch;
+    const now = options.now ?? (() => new Date());
+    const log = options.log ?? logger.child({ module: "coding-proxy" });
+    const gatewayUrl = options.gatewayUrl?.replace(/\/+$/, "");
+    return async (req, res) => {
+        const startedAt = performance.now();
+        const seen = {};
+        /** Refused before the body was read: close the connection rather than read what is still coming. */
+        const closeIfBodyUnread = () => {
+            if (!req.complete && !res.headersSent)
+                res.setHeader("connection", "close");
+        };
+        const send = (status, body, headers = JSON_HEADERS) => {
+            res.writeHead(status, headers).end(body);
+        };
+        try {
+            if (req.method !== "POST") {
+                closeIfBodyUnread();
+                res.setHeader("allow", "POST");
+                if (req.method === "HEAD")
+                    res.writeHead(405, JSON_HEADERS).end();
+                else
+                    send(405, rpcError(-32600, "Use POST."));
+                return;
+            }
+            if (!gatewayUrl) {
+                closeIfBodyUnread();
+                send(503, JSON.stringify({ error: "mcp_unavailable", message: MCP_UNAVAILABLE_MESSAGE }));
+                return;
+            }
+            const token = /^Bearer (\S+)$/.exec(req.headers.authorization ?? "")?.[1];
+            const session = isMcpToken(token)
+                ? await options.ledger.findSessionByMcpTokenHash(mcpTokenHash(token))
+                : undefined;
+            const at = now().getTime();
+            if (!session || session.status !== "active" || at >= session.deadlineAt.getTime()) {
+                // No WWW-Authenticate: a client must not start OAuth discovery against this route.
+                closeIfBodyUnread();
+                send(401, rpcError(-32001, MCP_TOKEN_REQUIRED_MESSAGE));
+                return;
+            }
+            seen.sessionId = session.id;
+            if (req.headers["content-type"]?.split(";", 1)[0].trim().toLowerCase() !== "application/json") {
+                closeIfBodyUnread();
+                send(415, rpcError(-32600, "Send one JSON-RPC message as application/json."));
+                return;
+            }
+            let body;
+            try {
+                body = await readBodyBytes(req, HTTP_LIMITS.json, AbortSignal.timeout(HTTP_LIMITS.requestMs));
+            }
+            catch (error) {
+                closeIfBodyUnread();
+                send(error instanceof HttpBoundaryError ? error.status : 400, rpcError(-32600, "The request body could not be read."));
+                return;
+            }
+            seen.method = methodOf(body);
+            // The call may take as long as it needs, up to the run's deadline or MCP_FORWARD_MAX_MS. The
+            // server's requestTimeout covers receiving the request only, which is over by now.
+            const controller = new AbortController();
+            const timer = setTimeout(() => controller.abort(new GatewayError("gateway_timeout")), Math.min(MCP_FORWARD_MAX_MS, session.deadlineAt.getTime() - at));
+            const clientGone = () => {
+                if (!res.writableFinished)
+                    controller.abort(new GatewayError("client_disconnected"));
+            };
+            res.once("close", clientGone);
+            try {
+                const upstream = await fetchImpl(`${gatewayUrl}${GATEWAY_PATH}`, {
+                    method: "POST",
+                    headers: { authorization: req.headers.authorization, "content-type": "application/json" },
+                    body: new Uint8Array(body),
+                    redirect: "error",
+                    signal: controller.signal,
+                });
+                const answer = await readGatewayBody(upstream);
+                send(upstream.status, answer, {
+                    "content-type": upstream.headers.get("content-type") ?? "application/json",
+                    "cache-control": "no-store",
+                });
+            }
+            catch (error) {
+                const reason = controller.signal.reason instanceof GatewayError ? controller.signal.reason.reason : undefined;
+                throw error instanceof GatewayError ? error : new GatewayError(reason ?? "gateway_unreachable");
+            }
+            finally {
+                clearTimeout(timer);
+                res.off("close", clientGone);
+            }
+        }
+        catch (error) {
+            // Nothing of the error's text leaves or is logged: only a fixed reason code.
+            seen.reason = error instanceof GatewayError ? error.reason : "gateway_unreachable";
+            if (!res.headersSent)
+                send(502, JSON.stringify({ error: "mcp_unavailable", message: MCP_UNREACHABLE_MESSAGE }));
+            else
+                res.destroy();
+        }
+        finally {
+            log.info({
+                event: "mcp.request",
+                ...(seen.sessionId ? { sessionId: seen.sessionId } : {}),
+                ...(seen.method ? { method: seen.method } : {}),
+                status: res.statusCode,
+                ...(seen.reason ? { reason: seen.reason } : {}),
+                durationMs: Math.round(performance.now() - startedAt),
+            }, "coding proxy mcp request");
+        }
+    };
+}