@wardby/cli 0.7.0 → 0.9.0

package/dist/mcp/tools/tools.js

@@ -13,9 +13,11 @@ import { Prisma } from "#prisma";
 import { deriveJsonSchema, validateParams } from "../../sandbox/zod-params.js";
 import { cachedZod4Compatibility, toolSubject, withZod3ToolWarnings, zod3SampleArgsWarning, zod3ToolWarnings, zod3WindowWarning, } from "../../core/zod3-window.js";
 import { runInSandbox } from "../../sandbox/run-in-sandbox.js";
+import { effectiveToolTimeoutMs, toolTimeoutProblem } from "../../sandbox/tool-timeout.js";
+import { loadToolMaxTimeoutMs } from "../../config/tool-timeout.js";
 import { ToolCapabilitiesPatchSchema } from "../../sandbox/tool-capabilities.js";
 import { buildSharedDatastoreAccessor } from "../../core/datastores.js";
-import { findSameNamedAttachedTool, reservedToolNameReason } from "../../core/tool-names.js";
+import { findSameNamedAttachedTool, findSameNamedMcpTool, reservedToolNameReason, sameNamedMcpToolMessage, } from "../../core/tool-names.js";
 import { ToolAttachedError, deleteToolGuarded, hasToolChanges, prepareToolUpdate, updateToolGuarded, } from "../../core/tool-admin.js";
 import { McpError } from "../errors.js";
 import { requireOwnedTool, requireStrictlyOwnedTool, assertStrictlyOwnedTool, visibleToPrincipal, canRead, } from "../auth/ownership.js";
@@ -46,9 +48,16 @@ async function describeAgents(agents, ctx) {
 export function projectTool(tool, principalId) {
     if (tool.ownerId !== null && tool.ownerId === principalId)
         return tool;
-    return tool.ownerId === null
-        ? { id: tool.id, name: tool.name, description: tool.description, public: true }
-        : { id: tool.id, name: tool.name, description: tool.description, public: false, ownerIsCaller: false };
+    // timeoutMs is not code: anyone who sees the tool sees how long its calls may take.
+    const shown = { id: tool.id, name: tool.name, description: tool.description, timeoutMs: tool.timeoutMs };
+    return tool.ownerId === null ? { ...shown, public: true } : { ...shown, public: false, ownerIsCaller: false };
+}
+const TIMEOUT_MS_DESCRIPTION = "The tool's time limit per call, in milliseconds (at least 1000). Omitted: the default of 10000. Capped by the server's WARDBY_TOOL_MAX_TIMEOUT_MS (default 300000); a larger value is refused. Each fetch times out just before it, and sleep() is capped at it.";
+/** Refuses (400) a timeoutMs this server can't store, naming its ceiling. */
+function assertToolTimeout(timeoutMs) {
+    const problem = toolTimeoutProblem(timeoutMs, loadToolMaxTimeoutMs());
+    if (problem)
+        throw new McpError(400, problem);
 }
 /**
  * Non-blocking: which of the secrets just granted to this attachment are
@@ -83,11 +92,14 @@ export function registerToolAuthoringTools(mcp) {
                 description: { type: "string" },
                 paramsZod: { type: "string" },
                 code: { type: "string" },
+                timeoutMs: { type: "integer", description: TIMEOUT_MS_DESCRIPTION },
             },
             required: ["name", "description", "paramsZod", "code"],
         },
         handler: async (args, ctx) => {
             assertToolNameAllowed(args.name);
+            if (args.timeoutMs !== undefined)
+                assertToolTimeout(args.timeoutMs);
             const schemaResult = await deriveJsonSchema(args.paramsZod);
             if (!schemaResult.ok) {
                 return textResult({ ok: false, errorKind: schemaResult.errorKind, errorMessage: schemaResult.errorMessage });
@@ -101,6 +113,7 @@ export function registerToolAuthoringTools(mcp) {
                         code: args.code,
                         jsonSchema: schemaResult.value,
                         ownerId: ctx.principal.id,
+                        ...(args.timeoutMs !== undefined ? { timeoutMs: args.timeoutMs } : {}),
                     },
                 });
                 const warnings = await zod3ToolWarnings(toolSubject(tool.name), args.paramsZod);
@@ -117,7 +130,7 @@ export function registerToolAuthoringTools(mcp) {
     mcp.registerTool({
         name: "update_tool",
         scope: "tools:write",
-        description: "Replaces a tool's description, paramsZod and/or code in place (its name can't change: agents' prompts call it by name). Owner-only: public tools can't be changed over MCP. Refused while the tool is attached to any agent you don't own, including owner-less ones and agents shared with you, since the change would reach another owner's agent; detach it there first or create a new tool. Runs already started keep the version they loaded for their whole lifetime; the next run picks up the new one.",
+        description: "Replaces a tool's description, paramsZod, code and/or timeoutMs (null: back to the default limit) in place (its name can't change: agents' prompts call it by name). Owner-only: public tools can't be changed over MCP. Refused while the tool is attached to any agent you don't own, including owner-less ones and agents shared with you, since the change would reach another owner's agent; detach it there first or create a new tool. Runs already started keep the version they loaded for their whole lifetime; the next run picks up the new one.",
         inputSchema: {
             type: "object",
             additionalProperties: false,
@@ -126,14 +139,25 @@ export function registerToolAuthoringTools(mcp) {
                 description: { type: "string" },
                 paramsZod: { type: "string" },
                 code: { type: "string" },
+                timeoutMs: {
+                    type: ["integer", "null"],
+                    description: `${TIMEOUT_MS_DESCRIPTION} Pass null to go back to the default.`,
+                },
             },
             required: ["toolId"],
         },
         handler: async (args, ctx) => {
-            const changes = { description: args.description, paramsZod: args.paramsZod, code: args.code };
+            const changes = {
+                description: args.description,
+                paramsZod: args.paramsZod,
+                code: args.code,
+                timeoutMs: args.timeoutMs,
+            };
             if (!hasToolChanges(changes)) {
-                throw new McpError(400, "update_tool needs at least one of description, paramsZod or code.");
+                throw new McpError(400, "update_tool needs at least one of description, paramsZod, code or timeoutMs.");
             }
+            if (args.timeoutMs !== undefined && args.timeoutMs !== null)
+                assertToolTimeout(args.timeoutMs);
             // Checked once up front so a non-owner never gets as far as a sandbox
             // compile, and again (with the attachments) inside the transaction.
             await requireStrictlyOwnedTool(ctx.db, args.toolId, ctx.principal.id);
@@ -196,7 +220,7 @@ export function registerToolAuthoringTools(mcp) {
     mcp.registerTool({
         name: "dry_run_tool",
         scope: "tools:write",
-        description: "Test-runs tool code against sample args without persisting it. Fetch is denied by default, same as a freshly attached tool — pass allowedHosts to test code that calls fetch(). For this release a paramsZod is still compiled with Zod 3; a `warnings` list in the result means the next release, which compiles it with Zod 4 only, will reject it or treat the sample args differently.",
+        description: "Test-runs tool code against sample args without persisting it, with the same time limit a run would give it (timeoutMs, as on create_tool). Fetch is denied by default, same as a freshly attached tool — pass allowedHosts to test code that calls fetch(). For this release a paramsZod is still compiled with Zod 3; a `warnings` list in the result means the next release, which compiles it with Zod 4 only, will reject it or treat the sample args differently.",
         inputSchema: {
             type: "object",
             properties: {
@@ -204,10 +228,13 @@ export function registerToolAuthoringTools(mcp) {
                 code: { type: "string" },
                 sampleArgs: { type: "object" },
                 allowedHosts: { type: "array", items: { type: "string" } },
+                timeoutMs: { type: "integer", description: TIMEOUT_MS_DESCRIPTION },
             },
             required: ["paramsZod", "code", "sampleArgs"],
         },
         handler: async (args, ctx) => {
+            if (args.timeoutMs !== undefined)
+                assertToolTimeout(args.timeoutMs);
             const hosts = ToolCapabilitiesPatchSchema.pick({ allowedHosts: true }).safeParse({
                 allowedHosts: args.allowedHosts,
             });
@@ -254,6 +281,7 @@ export function registerToolAuthoringTools(mcp) {
                 sharedDatastore: buildSharedDatastoreAccessor(ctx.principal.id, ctx.providers.datastore, ctx.db),
                 toolName: "dry_run_tool",
                 allowedFetchHosts: hosts.data.allowedHosts ?? [],
+                timeoutMs: effectiveToolTimeoutMs(args.timeoutMs, loadToolMaxTimeoutMs()),
             });
             return textResult({ jsonSchema, result: sandboxResult, ...warnings });
         },
@@ -334,6 +362,10 @@ export function registerToolAuthoringTools(mcp) {
                         : " (a tool owned by another principal)";
                     throw new McpError(409, `Agent "${args.agentId}" already has a different tool named "${tool.name}" attached${which}; detach it first.`);
                 }
+                // Nor a name one of the agent's MCP servers already gives the model.
+                const mcpClash = await findSameNamedMcpTool(tx, args.agentId, tool.name);
+                if (mcpClash)
+                    throw new McpError(409, sameNamedMcpToolMessage(args.agentId, tool.name, mcpClash.serverName));
                 // Re-granting an attachment this owner never vouched for: what is
                 // not restated is reset, never silently adopted.
                 const keepUnstated = existing?.capabilitiesGrantedById === agent.ownerId;

package/dist/mcp/tools/trigger.js

@@ -29,6 +29,7 @@
  * gets 404, not another principal's final text/cost.
  */
 import { dispatchRun } from "../../core/dispatch.js";
+import { RepositoryChoiceRefusedError, resolveCodingRepository } from "../../core/coding-repository.js";
 import { AttributionError, explicitAttribution, RESPONSE_PATH_SNAPSHOT_BUDGET, } from "../../core/attribution.js";
 import { CodingBaseRefSchema, CodingTaskOverrideSchema, isLocalRepository } from "../../coding/protocol.js";
 import { loadLocalRepoRoots, resolveLocalRepository, LocalRepoError } from "../../coding/local-repo.js";
@@ -46,6 +47,7 @@ const TriggerAgentSchema = z
     agentId: z.string().trim().min(1).max(128),
     task: CodingTaskOverrideSchema.optional(),
     baseRef: CodingBaseRefSchema.optional(),
+    repository: z.string().min(1).max(300).optional(),
     issue: z.unknown().optional(),
     review: z
         .object({
@@ -127,10 +129,10 @@ function assertOverrideAllowed(principalId, agent, args) {
     // Strictly the owner: the stdio operator's owner-level access doesn't make
     // it the owner whose repository authority the task steers (review M8).
     const isOwner = agent.ownerId !== null && agent.ownerId === principalId;
-    if (isOwner || (args.task === undefined && args.baseRef === undefined))
+    if (isOwner || (args.task === undefined && args.baseRef === undefined && args.repository === undefined))
         return;
     if (!agent.codingProfile?.allowWebhookTaskOverride) {
-        throw new McpError(403, `Agent "${agent.id}": only its owner can pass a task or baseRef, unless the owner allows it (codingProfile.allowWebhookTaskOverride).`);
+        throw new McpError(403, `Agent "${agent.id}": only its owner can pass a task, baseRef or repository, unless the owner allows it (codingProfile.allowWebhookTaskOverride).`);
     }
 }
 /** execute on the agent, plus the override rule; `db` is the transaction when re-checking. */
@@ -150,6 +152,10 @@ export function registerTriggerTool(mcp) {
                 agentId: { type: "string" },
                 task: { type: "string" },
                 baseRef: { type: "string" },
+                repository: {
+                    type: "string",
+                    description: "Coding agents only: a repository on the agent's list (see get_agent). Omit to use codingProfile.repository.",
+                },
                 review: {
                     type: "object",
                     additionalProperties: false,
@@ -189,13 +195,28 @@ export function registerTriggerTool(mcp) {
                 }
                 review = await resolveLocalReview(ctx, agent.id, args.review);
             }
-            if (agent.kind !== "coding" && (args.task !== undefined || args.baseRef !== undefined)) {
-                throw new McpError(400, "Task and baseRef overrides are only valid for coding agents.");
+            if (agent.kind !== "coding" &&
+                (args.task !== undefined || args.baseRef !== undefined || args.repository !== undefined)) {
+                throw new McpError(400, "Task, baseRef and repository overrides are only valid for coding agents.");
             }
             // A local repository is re-checked against the roots as they are now
             // (they can narrow after the agent was saved), before any run exists.
             let warnings = [];
-            const repository = agent.kind === "coding" ? agent.codingProfile?.repository : undefined;
+            // The resolver's refusal lists the agent's repositories, so it runs only
+            // after requireTriggerable (execute on the agent) and never echoes the
+            // requested value.
+            const refused = (err) => {
+                if (err instanceof RepositoryChoiceRefusedError)
+                    throw new McpError(400, `${err.code}: ${err.message}`);
+                throw err;
+            };
+            const repository = agent.kind === "coding" && agent.codingProfile
+                ? (await resolveCodingRepository(ctx.db, {
+                    agentId: agent.id,
+                    profile: agent.codingProfile,
+                    requested: args.repository,
+                }).catch(refused)).repository
+                : undefined;
             if (repository !== undefined && isLocalRepository(repository)) {
                 try {
                     const resolved = await resolveLocalRepository(repository, loadLocalRepoRoots(process.env).roots);
@@ -238,6 +259,7 @@ export function registerTriggerTool(mcp) {
                     trigger: "manual",
                     codingTask: args.task,
                     codingBaseRef: args.baseRef,
+                    codingRepository: args.repository,
                     attribution,
                     task: ctx.clientSupportsTasks ? { principalId: ctx.principal.id, ttlMs: DEFAULT_TASK_TTL_MS } : undefined,
                     triggeredById: ctx.principal.id,
@@ -262,7 +284,7 @@ export function registerTriggerTool(mcp) {
             catch (err) {
                 if (pullRequest)
                     await ctx.db.localPullRequest.deleteMany({ where: { id: pullRequest.id } }).catch(() => { });
-                throw err;
+                return refused(err);
             }
             if (ctx.clientSupportsTasks) {
                 if (!dispatched.task)

package/dist/mcp/transport/http-limits.d.ts

@@ -14,4 +14,6 @@ export declare class PayloadTooLargeError extends HttpBoundaryError {
 }
 export declare function canonicalUrl(value: string): URL;
 export declare function readBody(req: IncomingMessage, maxBytes: number, signal: AbortSignal): Promise<string>;
+/** readBody's bytes, undecoded (for a route that forwards the body unchanged). */
+export declare function readBodyBytes(req: IncomingMessage, maxBytes: number, signal: AbortSignal): Promise<Buffer>;
 export declare function parseBody(raw: string, contentType: string | undefined): unknown;

package/dist/mcp/transport/http-limits.js

@@ -23,7 +23,11 @@ export function canonicalUrl(value) {
     }
     return url;
 }
-export function readBody(req, maxBytes, signal) {
+export async function readBody(req, maxBytes, signal) {
+    return (await readBodyBytes(req, maxBytes, signal)).toString("utf8");
+}
+/** readBody's bytes, undecoded (for a route that forwards the body unchanged). */
+export function readBodyBytes(req, maxBytes, signal) {
     const length = req.headers["content-length"];
     if (length && (!/^\d+$/.test(length) || Number(length) > maxBytes))
         return Promise.reject(new PayloadTooLargeError());
@@ -55,7 +59,7 @@ export function readBody(req, maxBytes, signal) {
         };
         const end = () => {
             clean();
-            resolve(Buffer.concat(chunks, size).toString("utf8"));
+            resolve(Buffer.concat(chunks, size));
         };
         req.on("data", data);
         req.once("end", end);

package/dist/mcp/webhooks/ingress.js

@@ -18,11 +18,19 @@ export async function handleWebhookIngress(webhookId, req, db, executor, issueTr
     if (req.body.task !== undefined && codingTask === undefined) {
         return { status: 400, body: { error: "invalid_task" } };
     }
+    // `wardbyRepository`, not `repository`, for the same reason: a forwarded GitHub
+    // payload carries its own top-level `repository` object.
+    const repository = req.body.wardbyRepository;
+    if (repository !== undefined &&
+        (typeof repository !== "string" || repository.length === 0 || repository.length > 300)) {
+        return { status: 400, body: { error: "invalid_repository" } };
+    }
     // `wardbyIssue`, not `issue`: forwarded third-party payloads (GitHub, Jira)
     // carry their own top-level `issue` object, which is not ours to read.
     const result = await resolveWebhookRun(webhookId, secret, db, executor, codingTask, {
         issue: req.body.wardbyIssue,
         issueTrackers,
+        repository,
     });
     if (result.ok) {
         return { status: 202, body: { runId: result.runId } };
@@ -30,6 +38,8 @@ export async function handleWebhookIngress(webhookId, req, db, executor, issueTr
     switch (result.reason) {
         case "invalid_issue":
             return { status: 400, body: { error: "invalid_issue", error_description: result.message } };
+        case "invalid_repository":
+            return { status: 400, body: { error: "invalid_repository" } };
         case "not_found":
             return { status: 404, body: { error: "not_found" } };
         case "invalid_secret":

package/dist/native-worker/gateway-server.d.ts

@@ -10,7 +10,9 @@
  * session budget before the provider is called and settles at the provider's
  * reported usage; the worker's own usage numbers are never read.
  */
+import type { RunStepSink } from "../core/run-steps/types.js";
 import { createNativeRunTools, durableDelegate, type NativeRunFinishContext, type NativeRunProviders, type RunnerDb, type SandboxSessionSnapshot } from "../core/runner.js";
+import type { CodingMcpDeps } from "../core/coding-mcp.js";
 import { ReviewReadLedger } from "../core/review-reads.js";
 import type { LlmProvider, LlmStreamEvent } from "../providers/llm/types.js";
 import { PrismaGatewayLedger, type GatewaySessionRecord } from "./ledger.js";
@@ -26,6 +28,8 @@ export interface GatewayServerDeps {
     providers: NativeRunProviders;
     /** Delegation long-poll window; tests shorten it. */
     pollWindowMs?: number;
+    /** Serves POST /coding-mcp on the same listener (remote MCP servers for coding runs); unset → 404. */
+    codingMcp?: CodingMcpDeps;
 }
 /** What a request gets back: one JSON value, or a stream of model events. */
 export type GatewayResponse = {
@@ -63,7 +67,9 @@ interface RebuiltRun {
     delegation: Omit<Parameters<typeof durableDelegate>[0], "ledger" | "sessionId">;
 }
 /** Exported for its unit test; the HTTP handler is its only production caller. */
-export declare function streamModel(ctx: RebuiltRun, ledger: PrismaGatewayLedger, callId: string, params: GatewayParams<"llm.stream">): AsyncIterable<LlmStreamEvent>;
+export declare function streamModel(ctx: RebuiltRun, ledger: PrismaGatewayLedger, callId: string, params: GatewayParams<"llm.stream">, steps?: RunStepSink, 
+/** The request's bearer capability, redacted from the recorded steps like a secret value. */
+capability?: string): AsyncIterable<LlmStreamEvent>;
 /**
  * Logged (at warn) in place of a user tool's console line when that tool's redaction list cannot
  * be read: without the complete list the line cannot be shown to be free of its secret values, so
@@ -72,6 +78,17 @@ export declare function streamModel(ctx: RebuiltRun, ledger: PrismaGatewayLedger
 export declare const CONSOLE_WITHHELD_MESSAGE = "sandbox tool console line withheld: the tool's secret values could not be read";
 /** Serves one privileged bridge call for a worker (exported for tests). */
 export declare function hostCall(ctx: RebuiltRun, ledger: PrismaGatewayLedger, callId: string, params: GatewayParams<"host.call">): Promise<unknown>;
+/** Added to a tool's limit for one host call: the worker's own wall time ends the call first. */
+export declare const GATEWAY_HOST_CALL_MARGIN_MS = 20000;
+/** How long one host call of `tool` may take: its limit plus the margin, cut to the run's deadline. */
+export declare function hostCallTimeoutMs(ctx: {
+    session: {
+        deadlineAt: Date;
+    };
+    tools: {
+        toolTimeoutMs: (name: string) => number | undefined;
+    };
+}, tool: string, now?: number): number;
 /** The worker's terminal call: the run's one terminal write (masked by finishNativeRun), then the session ends. */
 export declare function finish(ctx: RebuiltRun, ledger: PrismaGatewayLedger, callId: string, params: GatewayParams<"finish">): Promise<null>;
 export {};

package/dist/native-worker/gateway-server.js

@@ -10,12 +10,14 @@
  * session budget before the provider is called and settles at the provider's
  * reported usage; the worker's own usage numbers are never read.
  */
+import { NativeStreamSteps, recordStreamSteps } from "../core/run-steps/native.js";
 import { createNativeRunTools, durableDelegate, failNativeRun, finishNativeRun, nativeRunIntegrations, recordNativeRunProgress, runDrivability, sandboxCapabilityHash, userToolSecretValues, } from "../core/runner.js";
 import { ReviewReadLedger } from "../core/review-reads.js";
 import { DELEGATE_TOOL_PREFIX } from "../core/tool-names.js";
 import { relayedOutputTokens } from "../providers/coding-proxy/interrupted.js";
 import { RoutingLlmProvider } from "../providers/llm/routing.js";
 import { isPrivilegedBridgeName } from "../sandbox/host-functions.js";
+import { DEFAULT_TOOL_TIMEOUT_MS } from "../sandbox/tool-timeout.js";
 import { forWorker, gatewayLog } from "./gateway.js";
 import { PrismaGatewayLedger } from "./ledger.js";
 import { GatewayError, GatewayRequestSchema, parseParams, } from "./protocol.js";
@@ -65,6 +67,7 @@ export function runSecretValues(ctx, capability) {
     return async () => [
         capability,
         ...(await userToolSecretValues(ctx.tools, Object.keys(ctx.snapshot.input.userTools))),
+        ...(await ctx.tools.mcpSecretValues()),
     ];
 }
 /**
@@ -127,7 +130,7 @@ async function handle(deps, authorization, body, scope) {
             return {
                 kind: "stream",
                 status: 200,
-                events: checkedEvents(streamModel(ctx, ledger, request.callId, params), scope.secretValues),
+                events: checkedEvents(streamModel(ctx, ledger, request.callId, params, deps.providers.runSteps, token), scope.secretValues),
             };
         case "llm.countTokens": {
             const p = params;
@@ -178,6 +181,7 @@ async function rebuild(deps, session) {
             repoAccess,
             issueTrackers,
             reviewReads,
+            deadlineAt: session.deadlineAt,
         }),
         finishContext: { runId: session.runId, db, providers, reviewHosts, repoAccess, issueTrackers },
         delegation: {
@@ -192,7 +196,9 @@ async function rebuild(deps, session) {
     };
 }
 /** Exported for its unit test; the HTTP handler is its only production caller. */
-export async function* streamModel(ctx, ledger, callId, params) {
+export async function* streamModel(ctx, ledger, callId, params, steps, 
+/** The request's bearer capability, redacted from the recorded steps like a secret value. */
+capability) {
     const req = params.request;
     if (req.model !== ctx.snapshot.input.agent.model)
         throw new GatewayError("not_allowed", "A run may only call its own model.");
@@ -207,6 +213,8 @@ export async function* streamModel(ctx, ledger, callId, params) {
     if (reserved.outcome === "budget_exhausted") {
         throw new GatewayError("budget_exhausted", "This run's budget cannot cover another model call.");
     }
+    // Run steps: what this call streams, and the results its request carries for the last turn.
+    const tap = steps ? new NativeStreamSteps(callId) : undefined;
     let settled = false;
     let sawEvent = false;
     // Set once the provider's response starts: it may bill hidden thinking or reasoning before any event.
@@ -235,6 +243,7 @@ export async function* streamModel(ctx, ledger, callId, params) {
                     costUsd: event.usage.costUsd,
                 });
             }
+            tap?.observe(event);
             yield event;
         }
     }
@@ -281,6 +290,8 @@ export async function* streamModel(ctx, ledger, callId, params) {
                 costUsd: ctx.llm.priceUsd(req.model, { inputTokens, outputTokens: output }),
             });
         }
+        // Recorded before the stream ends (bounded), so the next call's results find these steps.
+        await recordStreamSteps(steps, ctx.session.runId, tap, req.messages, capability ? [capability] : []);
     }
 }
 /** Output tokens of a cut stream's output: counted, else the deliberately high bytes / 3 estimate. */
@@ -335,9 +346,15 @@ export async function hostCall(ctx, ledger, callId, params) {
         }
         redact = values;
     }
-    const host = ctx.tools.privilegedHostFor(params.tool, AbortSignal.timeout(30_000), redact);
-    if (!host)
+    // The tool's own limit plus a margin (30 s for a default tool), never past the run's deadline,
+    // and aborted if the run is stopped meanwhile.
+    const stop = ctx.tools.watchStop();
+    const signal = AbortSignal.any([AbortSignal.timeout(hostCallTimeoutMs(ctx, params.tool)), stop.signal]);
+    const host = ctx.tools.privilegedHostFor(params.tool, signal, redact);
+    if (!host) {
+        stop.done();
         throw new GatewayError("not_allowed", `"${params.tool}" is not a user tool of this run.`);
+    }
     const bridge = host[params.bridge];
     const run = async () => {
         try {
@@ -348,11 +365,23 @@ export async function hostCall(ctx, ledger, callId, params) {
             throw new GatewayError("bridge_error", err instanceof Error ? err.message.slice(0, 1024) : "Host function failed.");
         }
     };
-    // Console lines are not worth a ledger row, and a secret value must never be stored in one
-    // (a secrets.get is a side-effect-free read, so a retried callId simply reads it again).
-    if (params.bridge === "__bridge_console" || params.bridge === "__bridge_secretsGet")
-        return run();
-    return replayable(ledger, ctx.session.id, callId, "host.call", run);
+    try {
+        // Console lines are not worth a ledger row, and a secret value must never be stored in one
+        // (a secrets.get is a side-effect-free read, so a retried callId simply reads it again).
+        if (params.bridge === "__bridge_console" || params.bridge === "__bridge_secretsGet")
+            return await run();
+        return await replayable(ledger, ctx.session.id, callId, "host.call", run);
+    }
+    finally {
+        stop.done();
+    }
+}
+/** Added to a tool's limit for one host call: the worker's own wall time ends the call first. */
+export const GATEWAY_HOST_CALL_MARGIN_MS = 20_000;
+/** How long one host call of `tool` may take: its limit plus the margin, cut to the run's deadline. */
+export function hostCallTimeoutMs(ctx, tool, now = Date.now()) {
+    const limitMs = (ctx.tools.toolTimeoutMs(tool) ?? DEFAULT_TOOL_TIMEOUT_MS) + GATEWAY_HOST_CALL_MARGIN_MS;
+    return Math.max(0, Math.min(limitMs, ctx.session.deadlineAt.getTime() - now));
 }
 /** Runs a one-shot call once per callId; a retry replays its recorded result. */
 async function replayable(ledger, sessionId, callId, method, run) {

package/dist/native-worker/gateway.d.ts

@@ -13,6 +13,7 @@
 import type { EngineResult, EngineRunContext } from "../providers/engine/types.js";
 import type { LlmStreamEvent } from "../providers/llm/types.js";
 import pino from "pino";
+import type { RunStepSink } from "../core/run-steps/types.js";
 import { type PrivilegedHost } from "../sandbox/host-functions.js";
 import { logger } from "../core/logger.js";
 import { GatewayError, type WorkerInput } from "./protocol.js";
@@ -63,8 +64,12 @@ export interface SandboxedEngineOptions {
      * the run's values is not sent to the worker; without this, no cause code is sent.
      */
     readableSecretValues?: (tool: string) => Promise<string[]>;
+    /** Every secret value of the run's attached MCP servers, checked the same way. */
+    mcpSecretValues?: () => Promise<string[]>;
     drivability: () => Promise<RunDrivability>;
     launcher: WorkerLauncher;
+    /** Records the run's steps (src/core/run-steps); absent = none. */
+    runSteps?: RunStepSink;
 }
 /** Runs one native run's engine in a worker and returns its result with gateway-metered usage. */
 export declare function runSandboxedEngine(options: SandboxedEngineOptions): Promise<EngineResult>;

package/dist/native-worker/gateway.js

@@ -11,6 +11,7 @@
  * sandbox bridges are served only by name from the run's own surface.
  */
 import pino from "pino";
+import { NativeStreamSteps, recordStreamSteps } from "../core/run-steps/native.js";
 import { isPrivilegedBridgeName, redactExactSecretValues, withEscapedForms, } from "../sandbox/host-functions.js";
 import { logger } from "../core/logger.js";
 import { declaredCodeOf } from "../core/error-code.js";
@@ -116,8 +117,12 @@ export async function runSandboxedEngine(options) {
     };
     /** The run's readable secret values, for checking a failure's cause code before the worker sees it. */
     const readable = options.readableSecretValues;
+    const mcpValues = options.mcpSecretValues;
     const runSecretValues = readable
-        ? async () => (await Promise.all(Object.keys(input.userTools).map((tool) => readable(tool)))).flat()
+        ? async () => [
+            ...(await Promise.all(Object.keys(input.userTools).map((tool) => readable(tool)))).flat(),
+            ...(mcpValues ? await mcpValues() : []),
+        ]
         : undefined;
     const served = {
         async *stream(raw) {
@@ -130,6 +135,9 @@ export async function runSandboxedEngine(options) {
             const req = params.request;
             let sawDone = false;
             let streamedText = "";
+            // Run steps: what this call streams, and the results its request carries for the last turn.
+            const sink = options.runSteps;
+            const steps = sink ? new NativeStreamSteps(request.callId) : undefined;
             try {
                 for await (const event of llm.stream(req, controller.signal)) {
                     if (event.type === "done") {
@@ -139,6 +147,7 @@ export async function runSandboxedEngine(options) {
                     else if (event.type === "text") {
                         streamedText += event.delta;
                     }
+                    steps?.observe(event);
                     yield event;
                 }
             }
@@ -153,6 +162,9 @@ export async function runSandboxedEngine(options) {
                         : 0;
                     meter({ inputTokens, outputTokens, costUsd: llm.priceUsd(req.model, { inputTokens, outputTokens }) });
                 }
+                // Recorded before the stream ends (bounded), so the next call's results find these steps.
+                // The run's capability (when the worker has one) is redacted like a secret value.
+                await recordStreamSteps(sink, runId, steps, req.messages, input.gateway ? [input.gateway.capability] : []);
             }
         },
         async call(raw) {

package/dist/native-worker/http-server.d.ts

@@ -7,16 +7,18 @@
  *   POST /native-gateway/v1/call   body: GatewayRequest
  *   → application/json            { ok: true, result } | { ok: false, error: { code, message } }
  *   → application/x-ndjson        (llm.stream) { event } … then { end: true } or { error: { code, message, causeCode? } }
+ *
+ *   POST /coding-mcp               a coding run's MCP calls, forwarded by the coding proxy's /mcp route
+ *                                  (src/core/coding-mcp.ts); its own auth: the run's MCP token, not a
+ *                                  gateway capability. 404 when the listener was started without it.
  */
 import { type Server } from "node:http";
+import { type ListenAddress } from "../core/listen-address.js";
 import { type GatewayServerDeps } from "./gateway-server.js";
 /** The HTTP listener's own log. Exported so tests can watch it. */
 export declare const httpLog: import("pino").Logger<never, boolean>;
 export declare const NATIVE_GATEWAY_PATH = "/native-gateway/v1/call";
-export interface NativeGatewayListen {
-    host: string;
-    port: number;
-}
+export type NativeGatewayListen = ListenAddress;
 /** Parses NATIVE_GATEWAY_LISTEN ("host:port" or ":port"); undefined when unset. */
 export declare function parseGatewayListen(value: string | undefined): NativeGatewayListen | undefined;
 export declare function createGatewayServer(deps: GatewayServerDeps): Server;

package/dist/native-worker/http-server.js

@@ -7,9 +7,16 @@
  *   POST /native-gateway/v1/call   body: GatewayRequest
  *   → application/json            { ok: true, result } | { ok: false, error: { code, message } }
  *   → application/x-ndjson        (llm.stream) { event } … then { end: true } or { error: { code, message, causeCode? } }
+ *
+ *   POST /coding-mcp               a coding run's MCP calls, forwarded by the coding proxy's /mcp route
+ *                                  (src/core/coding-mcp.ts); its own auth: the run's MCP token, not a
+ *                                  gateway capability. 404 when the listener was started without it.
  */
 import { createServer } from "node:http";
+import { CODING_MCP_PATH, handleCodingMcpRequest } from "../core/coding-mcp.js";
+import { parseListenAddress } from "../core/listen-address.js";
 import { logger } from "../core/logger.js";
+import { HTTP_LIMITS, HttpBoundaryError, readBody as readLimitedBody } from "../mcp/transport/http-limits.js";
 import { logUnexpectedError } from "./gateway.js";
 import { serveGatewayRequest } from "./gateway-server.js";
 import { GatewayError, MAX_MESSAGE_BYTES, toGatewayError } from "./protocol.js";
@@ -18,14 +25,7 @@ export const httpLog = logger.child({ module: "native-gateway-http" });
 export const NATIVE_GATEWAY_PATH = "/native-gateway/v1/call";
 /** Parses NATIVE_GATEWAY_LISTEN ("host:port" or ":port"); undefined when unset. */
 export function parseGatewayListen(value) {
-    if (!value)
-        return undefined;
-    const match = /^(.*):(\d{1,5})$/.exec(value.trim());
-    const port = match ? Number(match[2]) : NaN;
-    if (!match || !Number.isInteger(port) || port < 1 || port > 65_535) {
-        throw new Error(`NATIVE_GATEWAY_LISTEN must be host:port or :port (got "${value}").`);
-    }
-    return { host: match[1] || "0.0.0.0", port };
+    return parseListenAddress("NATIVE_GATEWAY_LISTEN", value);
 }
 function readBody(req) {
     return new Promise((resolve, reject) => {
@@ -58,6 +58,10 @@ export function createGatewayServer(deps) {
                 send(healthy ? 200 : 503, { ok: healthy });
                 return;
             }
+            if (new URL(req.url ?? "/", "http://gateway").pathname === CODING_MCP_PATH && deps.codingMcp) {
+                await serveCodingMcp(req, res, deps.codingMcp);
+                return;
+            }
             if (req.method !== "POST" || req.url !== NATIVE_GATEWAY_PATH) {
                 send(404, { ok: false, error: { code: "not_found", message: "not found" } });
                 return;
@@ -101,6 +105,47 @@ export function createGatewayServer(deps) {
         });
     });
 }
+/** /coding-mcp: one JSON-RPC message per POST, answered as one JSON body (or 202 with none). */
+async function serveCodingMcp(req, res, deps) {
+    if (req.method !== "POST") {
+        res.setHeader("allow", "POST");
+        res.setHeader("content-type", "application/json");
+        res.writeHead(405);
+        res.end(JSON.stringify({ jsonrpc: "2.0", id: null, error: { code: -32600, message: "Use POST." } }));
+        return;
+    }
+    let body;
+    try {
+        body = await readLimitedBody(req, HTTP_LIMITS.json, AbortSignal.timeout(HTTP_LIMITS.requestMs));
+    }
+    catch (err) {
+        const status = err instanceof HttpBoundaryError ? err.status : 400;
+        res.setHeader("content-type", "application/json");
+        res.writeHead(status);
+        res.end(JSON.stringify({
+            jsonrpc: "2.0",
+            id: null,
+            error: { code: -32600, message: "The request body could not be read." },
+        }));
+        // A body left unread would otherwise keep the socket busy.
+        if (status === 413)
+            req.resume();
+        return;
+    }
+    // The proxy gives up on a call at its forward limit (or its worker goes away): the closed response
+    // aborts the call in flight rather than leave it running against the MCP server.
+    const closed = new AbortController();
+    res.on("close", () => {
+        if (!res.writableFinished)
+            closed.abort();
+    });
+    const response = await handleCodingMcpRequest(req.headers.authorization, body, deps, closed.signal);
+    if (closed.signal.aborted)
+        return;
+    res.setHeader("content-type", response.contentType);
+    res.writeHead(response.status);
+    res.end(response.body);
+}
 /** Starts the listener; resolves once it is accepting connections. */
 export async function startGatewayServer(listen, deps) {
     const server = createGatewayServer(deps);