agent-relay-runner 0.89.2 → 0.91.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-relay-runner",
-  "version": "0.89.2",
+  "version": "0.91.0",
   "description": "Unified provider lifecycle runner for Agent Relay",
   "type": "module",
   "bin": {
@@ -20,7 +20,7 @@
     "directory": "runner"
   },
   "dependencies": {
-    "agent-relay-sdk": "0.2.68"
+    "agent-relay-sdk": "0.2.70"
   },
   "devDependencies": {
     "@types/bun": "latest",

package/plugins/claude/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "agent-relay-runner",
   "description": "Thin Agent Relay runner bridge for Claude Code",
-  "version": "0.89.2",
+  "version": "0.91.0",
   "agentRelayContracts": {
     "providerPluginProtocol": 1
   }

package/src/adapter.ts

@@ -100,6 +100,10 @@ export interface RunnerSpawnConfig {
   // Stage 2 (#215): the MCP endpoint the agent connects to — the runner-local proxy URL when the
   // proxy is active. Undefined → the adapter targets the relay's MCP endpoint directly (Stage 1).
   relayMcpEndpoint?: string;
+  // #672: the shared host-listener URL the per-agent `callmux bridge` connects to, when the
+  // profile/spawn opted into `agentProfile.sharedMcp`. Resolved runner-side (env → default);
+  // the launch assembler only emits the bridge entry when sharedMcp is on.
+  sharedMcpUrl?: string;
   monitor?: {
     deliver(messages: Message[]): Promise<number[]>;
   };

package/src/launch-assembly.ts

@@ -1,6 +1,6 @@
 import { existsSync, readdirSync } from "node:fs";
 import { resolve, join } from "node:path";
-import type { AgentProfile, AgentProfileBase, SpawnProvider } from "agent-relay-sdk";
+import type { AgentProfile, AgentProfileBase, ProvisioningMcpServer, SpawnProvider } from "agent-relay-sdk";
 import {
   profileAllowsRelayFeature,
   profileIsVanillaBase,
@@ -13,14 +13,18 @@ import {
   resolveClaudeProvisionedPlugins,
   resolveClaudeProvisionedSkills,
   resolveCodexProvisionedSkills,
+  resolveProjectMcpServers,
   profileProvisioning,
 } from "./provisioning";
 import {
   claudeMcpLaunchArgs,
   codexProvisionedMcpArgs,
   relayMcpCodexConfigArgs,
+  resolveSharedMcpUrl,
+  sharedMcpBridgeServer,
   tomlString,
   RELAY_MCP_SERVER_NAME,
+  SHARED_MCP_SERVER_NAME,
 } from "./relay-mcp";
 
 // #557 — THE single launch-assembly contract. Given a resolved AgentProfile (+ its
@@ -73,11 +77,24 @@ export interface AssembledMcp {
   strict: boolean;
   /** Relay-provisioned server names (excludes the relay endpoint itself). */
   servers: string[];
+  /** #667 — project `.mcp.json` server names projected from the spawn cwd's committed
+   *  `.mcp.json` (via `--mcp-config`, so they survive strict). Sourced from the project,
+   *  not ambient host MCP. Empty unless the profile/spawn opted into `projectMcp`, and a
+   *  name already declared by relay-provisioned `servers` wins (not double-listed here). */
+  projectServers: string[];
   /** #662 — host USER-scope MCP server names (`~/.claude.json` `mcpServers`) re-injected
    *  into `--mcp-config` for an `mcp.mode:"host"` profile, so `--strict-mcp-config` keeps
    *  the ambient host MCP (callmux/qmd/gh) instead of dropping it. Empty for non-host mcp
    *  modes, isolated bases (own config home, never had host MCP), and Codex. */
   hostServers: string[];
+  /** #672 — when the profile/spawn opted into `sharedMcp`, the agent's NON-IDENTITY MCP
+   *  (tokenlean, github) is routed through one orchestrator-owned shared `callmux` listener via
+   *  a per-agent `callmux bridge --cwd "$WORKTREE"` (session-cwd isolation), injected through
+   *  the same `--mcp-config` / `-c` channel so it survives strict. `url` is the listener the
+   *  bridge connects to. Undefined when projection is OFF (the default). The bridge is opaque
+   *  at assembly time — its server SET is owned by the listener config, not enumerated here.
+   *  The identity-bearing relay endpoint is never on the shared listener (#215). */
+  sharedListener?: { url: string };
 }
 
 export interface AssembledLaunch {
@@ -202,6 +219,34 @@ function assembleClaude(config: RunnerSpawnConfig, providerConfig: ProviderConfi
   const mcpServers = Object.keys(provisionedMcp).filter((name) => name !== RELAY_MCP_SERVER_NAME);
   const relayEndpoint = profileAllowsRelayFeature(config, "mcp");
 
+  // #667 — project `.mcp.json` projection (opt-in). The spawn cwd's committed servers are
+  // injected through the SAME `--mcp-config` channel as relay-provisioned servers, so they
+  // survive `--strict-mcp-config` without the ambient project-discovery modal. A relay-
+  // provisioned server of the same name wins (the profile is the explicit, relay-owned
+  // source); the relay endpoint name is reserved. `declaredMcp` is the union relay injects.
+  const projectMcpRaw = resolveProjectMcpServers(config);
+  const projectMcp = Object.fromEntries(
+    Object.entries(projectMcpRaw).filter(
+      ([name]) => name !== RELAY_MCP_SERVER_NAME && !(name in provisionedMcp),
+    ),
+  );
+  const projectServers = Object.keys(projectMcp);
+
+  // #672 — shared host-listener MCP (opt-in, default OFF). When on, route the agent's
+  // NON-IDENTITY MCP (tokenlean, github) through ONE orchestrator-owned shared `callmux`
+  // listener via a per-agent `callmux bridge --url <listener> --cwd "$WORKTREE"` stdio entry:
+  // the MCP session survives a listener/downstream restart, and --cwd gives each isolated
+  // worktree session-cwd isolation. It's a plain stdio server descriptor, so it rides the same
+  // controlled --mcp-config channel as provisioned servers (survives --strict-mcp-config) — no
+  // ambient discovery, no modal. Relay-owned infra → authoritative on its name (spread last);
+  // the relay endpoint stays per-agent (#215), NEVER on the shared listener.
+  const sharedListenerOn = Boolean(config.agentProfile?.sharedMcp);
+  const sharedListenerUrl = sharedListenerOn ? resolveSharedMcpUrl(config.sharedMcpUrl) : undefined;
+  const sharedMcp: Record<string, ProvisioningMcpServer> = sharedListenerUrl
+    ? { [SHARED_MCP_SERVER_NAME]: sharedMcpBridgeServer(sharedListenerUrl, config.cwd) }
+    : {};
+  const declaredMcp = { ...projectMcp, ...provisionedMcp, ...sharedMcp };
+
   // #662 — EVERY managed Claude launch is --strict-mcp-config, not just vanilla. A managed
   // agent runs headless (no human at the keyboard), so Claude's blocking "N new MCP servers
   // found in this project — select to enable" modal (raised on UNDECIDED cwd `.mcp.json`
@@ -224,7 +269,7 @@ function assembleClaude(config: RunnerSpawnConfig, providerConfig: ProviderConfi
     && (!config.agentProfile || config.agentProfile.mcp.mode === "host");
   const hostMcp = usesHostMcp ? hostUserScopeMcpServers() : {};
   const hostMcpServers = Object.keys(hostMcp).filter(
-    (name) => name !== RELAY_MCP_SERVER_NAME && !(name in provisionedMcp),
+    (name) => name !== RELAY_MCP_SERVER_NAME && !(name in declaredMcp),
   );
 
   const instructions = assembleInstructions(config);
@@ -238,7 +283,7 @@ function assembleClaude(config: RunnerSpawnConfig, providerConfig: ProviderConfi
       relayUrl: config.relayUrl,
       ...(config.relayMcpEndpoint ? { endpoint: config.relayMcpEndpoint } : {}),
       includeRelay: relayEndpoint,
-      servers: provisionedMcp,
+      servers: declaredMcp,
       hostServers: hostMcp,
       strict: strictMcp,
     }),
@@ -258,7 +303,10 @@ function assembleClaude(config: RunnerSpawnConfig, providerConfig: ProviderConfi
     statusLine,
     skills: skills.map((s) => ({ name: s.name, dir: s.dir })),
     plugins: provisionedPlugins.map((p) => ({ name: p.name, dir: p.dir })),
-    mcp: { relayEndpoint, strict: strictMcp, servers: mcpServers, hostServers: hostMcpServers },
+    mcp: {
+      relayEndpoint, strict: strictMcp, servers: mcpServers, projectServers, hostServers: hostMcpServers,
+      ...(sharedListenerUrl ? { sharedListener: { url: sharedListenerUrl } } : {}),
+    },
     instructions,
     args,
     env: configHome ? { CLAUDE_CONFIG_DIR: configHome } : {},
@@ -278,6 +326,29 @@ function assembleCodex(config: RunnerSpawnConfig, _providerConfig: ProviderConfi
   const provisionedMcp = profileProvisioning(config).mcpServers;
   const mcpServers = Object.keys(provisionedMcp).filter((name) => name !== RELAY_MCP_SERVER_NAME);
 
+  // #667 — project `.mcp.json` projection (opt-in), same union rule as Claude: a relay-
+  // provisioned server of the same name wins; the relay endpoint name is reserved. Codex has
+  // no `.mcp.json` discovery of its own, so this is purely additive (no strict/modal concern).
+  const projectMcpRaw = resolveProjectMcpServers(config);
+  const projectMcp = Object.fromEntries(
+    Object.entries(projectMcpRaw).filter(
+      ([name]) => name !== RELAY_MCP_SERVER_NAME && !(name in provisionedMcp),
+    ),
+  );
+  const projectServers = Object.keys(projectMcp);
+
+  // #672 — shared host-listener MCP (opt-in, default OFF), same as Claude: a per-agent
+  // `callmux bridge --url <listener> --cwd "$WORKTREE"` stdio entry routes the agent's
+  // NON-IDENTITY MCP (tokenlean, github) through the shared listener (session survives a
+  // restart; --cwd gives session-cwd isolation). Emitted via the same `-c mcp_servers.*`
+  // overrides as provisioned servers. The relay endpoint stays per-agent (#215).
+  const sharedListenerOn = Boolean(config.agentProfile?.sharedMcp);
+  const sharedListenerUrl = sharedListenerOn ? resolveSharedMcpUrl(config.sharedMcpUrl) : undefined;
+  const sharedMcp: Record<string, ProvisioningMcpServer> = sharedListenerUrl
+    ? { [SHARED_MCP_SERVER_NAME]: sharedMcpBridgeServer(sharedListenerUrl, config.cwd) }
+    : {};
+  const declaredMcp = { ...projectMcp, ...provisionedMcp, ...sharedMcp };
+
   const instructions = assembleInstructions(config);
 
   // The skills/MCP/project-doc block; core launch config (model/approval/listen) stays
@@ -285,7 +356,7 @@ function assembleCodex(config: RunnerSpawnConfig, _providerConfig: ProviderConfi
   const args = [
     ...bundledSkillConfigArgs(skillDirs),
     ...(relayEndpoint ? relayMcpCodexConfigArgs(config.relayUrl, config.relayMcpEndpoint) : []),
-    ...codexProvisionedMcpArgs(provisionedMcp),
+    ...codexProvisionedMcpArgs(declaredMcp),
     ...codexProjectDocSuppressionArgs(config),
   ];
 
@@ -301,7 +372,10 @@ function assembleCodex(config: RunnerSpawnConfig, _providerConfig: ProviderConfi
     statusLine: false,
     skills: provisionedSkills.map((s) => ({ name: s.name, dir: s.dir })),
     plugins: [],
-    mcp: { relayEndpoint, strict: false, servers: mcpServers, hostServers: [] },
+    mcp: {
+      relayEndpoint, strict: false, servers: mcpServers, projectServers, hostServers: [],
+      ...(sharedListenerUrl ? { sharedListener: { url: sharedListenerUrl } } : {}),
+    },
     instructions,
     args,
     env: configHome ? { CODEX_HOME: configHome } : {},

package/src/profile-projection.ts

@@ -33,6 +33,8 @@ export function agentProfileProjectionReport(input: AgentProfileProjectionInput)
   add(provisioningSkillsEntry(assembled));
   add(provisioningPluginsEntry(assembled));
   add(provisioningMcpEntry(assembled));
+  add(projectMcpEntry(assembled));
+  add(sharedMcpEntry(assembled));
   if (profile) add(filesystemEntry(profile));
   add(configHomeEntry(assembled));
   if (assembled.vanilla) add(vanillaLaunchEntry(provider));
@@ -143,6 +145,33 @@ function provisioningMcpEntry(a: AssembledLaunch): AgentProfileProjectionEntry {
     : `Relay-provisioned MCP servers emitted as -c mcp_servers.* overrides (${names.join(", ")}).`);
 }
 
+// #667 — project `.mcp.json` projection provenance. `not-applicable` when the profile/spawn
+// didn't opt in (the default); `applied` lists the spawn-cwd servers relay injected through
+// the controlled --mcp-config / -c path (sourced from the project, not ambient host MCP).
+function projectMcpEntry(a: AssembledLaunch): AgentProfileProjectionEntry {
+  const optedIn = Boolean(a.profile?.projectMcp);
+  const names = a.mcp.projectServers;
+  if (!optedIn) return notApplicable("projectMcp", "off", "Project .mcp.json projection is off (opt in via the projectMcp profile/spawn option).");
+  if (!names.length) return applied("projectMcp", "none", "Project .mcp.json projection is on, but the spawn cwd declared no injectable MCP servers.");
+  const label = `${names.length} server${names.length === 1 ? "" : "s"}`;
+  return applied("projectMcp", label, a.provider === "claude"
+    ? `Project .mcp.json servers composed into --mcp-config (${names.join(", ")})${a.mcp.strict ? "; survives --strict-mcp-config" : ""}.`
+    : `Project .mcp.json servers emitted as -c mcp_servers.* overrides (${names.join(", ")}).`);
+}
+
+// #672 — shared host-listener MCP provenance. `not-applicable` when the profile/spawn didn't
+// opt in (the default); `applied` reports the per-agent `callmux bridge` routing the agent's
+// non-identity MCP (tokenlean, github) through the shared listener it points at. The server SET
+// is owned by the listener config, so this surfaces the route + URL, not an enumerated list.
+function sharedMcpEntry(a: AssembledLaunch): AgentProfileProjectionEntry {
+  const optedIn = Boolean(a.profile?.sharedMcp);
+  const listener = a.mcp.sharedListener;
+  if (!optedIn || !listener) return notApplicable("sharedMcp", "off", "Shared host-listener MCP is off (opt in via the sharedMcp profile/spawn option); non-identity MCP is injected per-agent.");
+  return applied("sharedMcp", "on", a.provider === "claude"
+    ? `Non-identity MCP (e.g. tokenlean, github) routed through the shared callmux listener (${listener.url}) via a per-agent 'callmux bridge --cwd "$WORKTREE"', injected into --mcp-config (survives --strict-mcp-config); session survives a listener restart, session-cwd isolated. Relay endpoint stays per-agent (#215).`
+    : `Non-identity MCP (e.g. tokenlean, github) routed through the shared callmux listener (${listener.url}) via a per-agent 'callmux bridge --cwd "$WORKTREE"' emitted as -c mcp_servers.* overrides; session survives a listener restart, session-cwd isolated. Relay endpoint stays per-agent (#215).`);
+}
+
 function globalInstructionsEntry(a: AssembledLaunch): AgentProfileProjectionEntry {
   const disposition = a.instructions.global;
   if (disposition === "allow") return applied("instructions.global", "allow", "Host/global provider instructions are left available.");

package/src/provisioning.ts

@@ -1,7 +1,7 @@
-import { existsSync, mkdirSync, rmSync, symlinkSync, writeFileSync } from "node:fs";
+import { existsSync, mkdirSync, readFileSync, rmSync, symlinkSync, writeFileSync } from "node:fs";
 import { dirname, isAbsolute, join, resolve } from "node:path";
 import { sanitizeFsName } from "agent-relay-sdk/fs-name";
-import type { ProvisioningAssetFile, ResolvedProvisioning } from "agent-relay-sdk";
+import type { ProvisioningAssetFile, ProvisioningMcpServer, ResolvedProvisioning } from "agent-relay-sdk";
 import type { RunnerSpawnConfig } from "./adapter";
 
 // Runner-side materialization of the relay-resolved provisioning bundle
@@ -24,6 +24,56 @@ export function profileProvisioning(config: Pick<RunnerSpawnConfig, "agentProfil
   return { skills: p.skills ?? [], plugins: p.plugins ?? [], mcpServers: p.mcpServers ?? {} };
 }
 
+// The `mcpServers` keys a Claude `.mcp.json` entry may carry; coerced into the
+// provider-neutral ProvisioningMcpServer shape so the launch assembler projects them the
+// same way it does relay-provisioned servers (Claude `--mcp-config`, Codex `-c mcp_servers.*`).
+function coerceProjectMcpServer(raw: unknown): ProvisioningMcpServer | null {
+  if (!raw || typeof raw !== "object") return null;
+  const r = raw as Record<string, unknown>;
+  const server: ProvisioningMcpServer = {};
+  if (r.type === "stdio" || r.type === "http" || r.type === "sse") server.type = r.type;
+  if (typeof r.command === "string") server.command = r.command;
+  if (Array.isArray(r.args) && r.args.every((a) => typeof a === "string")) server.args = r.args as string[];
+  if (r.env && typeof r.env === "object") server.env = r.env as Record<string, string>;
+  if (typeof r.url === "string") server.url = r.url;
+  if (r.headers && typeof r.headers === "object") server.headers = r.headers as Record<string, string>;
+  // Drop an entry that names no transport (neither a command nor a url) — nothing to launch.
+  return server.command || server.url ? server : null;
+}
+
+// #667 — project `.mcp.json` MCP projection. OPT-IN via the resolved profile's `projectMcp`
+// (set per-spawn or by profile, relay-side). Reads the spawn cwd's COMMITTED `.mcp.json` and
+// returns its `mcpServers` as a provider-neutral record, so the launch assembler injects them
+// through the CONTROLLED `--mcp-config` (Claude) / `-c mcp_servers.*` (Codex) path that
+// survives `--strict-mcp-config` — the project's own servers travel with the repo like they do
+// for a human who clones it, WITHOUT enabling Claude's ambient project-discovery trust modal
+// (which wedges headless agents, the reason #662 made every managed launch strict). The runner
+// is the filesystem authority for the spawn cwd (relay may run on another host), so the read
+// lands here. Best-effort: a missing/malformed file (or one with no `mcpServers`) yields {} and
+// never aborts the launch. Returns {} when projection is OFF.
+export function resolveProjectMcpServers(
+  config: Pick<RunnerSpawnConfig, "agentProfile" | "cwd">,
+): Record<string, ProvisioningMcpServer> {
+  if (!config.agentProfile?.projectMcp) return {};
+  const file = join(config.cwd, ".mcp.json");
+  if (!existsSync(file)) return {};
+  let parsed: unknown;
+  try {
+    parsed = JSON.parse(readFileSync(file, "utf8"));
+  } catch (err) {
+    console.warn(`project .mcp.json projection: failed to parse ${file}: ${(err as Error).message}`);
+    return {};
+  }
+  const servers = (parsed as { mcpServers?: unknown } | null)?.mcpServers;
+  if (!servers || typeof servers !== "object") return {};
+  const out: Record<string, ProvisioningMcpServer> = {};
+  for (const [name, raw] of Object.entries(servers as Record<string, unknown>)) {
+    const server = coerceProjectMcpServer(raw);
+    if (server) out[name] = server;
+  }
+  return out;
+}
+
 // A resolved provisioning asset: WHERE it lands (`dir`) and HOW it materializes
 // (`source`). `files` writes the inline set into `dir`; `link` symlinks a pre-existing
 // source dir at `dir`; `inPlace` uses the source dir as-is (no write, dir IS the source).

package/src/relay-injection-events.ts

@@ -39,6 +39,7 @@ function launchInjectionEvents(input: RunnerLaunchInjectionInput): KeyedRelayInj
   if (!supportsLaunchAssembly(input.provider)) return events;
   const assembled = assembleLaunch(input.provider, input.config, input.providerConfig);
   const toolCount = assembled.skills.length + assembled.plugins.length + assembled.mcp.servers.length
+    + assembled.mcp.projectServers.length
     + (assembled.relaySkills ? 1 : 0)
     + (assembled.relayPlugin ? 1 : 0)
     + (assembled.mcp.relayEndpoint ? 1 : 0)
@@ -52,6 +53,7 @@ function launchInjectionEvents(input: RunnerLaunchInjectionInput): KeyedRelayInj
     assembled.skills.length ? `${assembled.skills.length} skill${assembled.skills.length === 1 ? "" : "s"}` : "",
     assembled.plugins.length ? `${assembled.plugins.length} plugin${assembled.plugins.length === 1 ? "" : "s"}` : "",
     assembled.mcp.servers.length ? `${assembled.mcp.servers.length} MCP server${assembled.mcp.servers.length === 1 ? "" : "s"}` : "",
+    assembled.mcp.projectServers.length ? `${assembled.mcp.projectServers.length} project MCP server${assembled.mcp.projectServers.length === 1 ? "" : "s"}` : "",
   ].filter(Boolean);
   events.push({
     key: "tools",

package/src/relay-mcp.ts

@@ -19,6 +19,24 @@ export const RELAY_MCP_SERVER_NAME = "agent-relay";
 export const RELAY_MCP_PATH = "/api/mcp";
 export const RELAY_MCP_TOKEN_ENV = "AGENT_RELAY_SESSION_TOKEN";
 
+// #672 — shared host-listener MCP. The agent connects to ONE orchestrator-owned shared
+// `callmux` listener via a per-agent `callmux bridge`, fronting the host's NON-IDENTITY MCP
+// (tokenlean, github). The bridge is a stdio child (auto-reconnect + retry-once on a
+// listener/downstream hiccup; `--cwd` injects `x-callmux-cwd` for per-worktree session-cwd
+// isolation), so it rides the SAME provider injection as any provisioned stdio server. The
+// identity-bearing relay endpoint is NEVER routed here — it stays per-agent on #215.
+export const SHARED_MCP_SERVER_NAME = "callmux";
+// callmux's documented manual-listener endpoint (`callmux --listen 4860`, Streamable HTTP at
+// /mcp). In managed launches the orchestrator owns the real listener URL and passes it through
+// AGENT_RELAY_SHARED_MCP_URL; this fallback is for direct runner/manual-listener use.
+export const DEFAULT_SHARED_MCP_URL = "http://localhost:4860/mcp";
+export const SHARED_MCP_URL_ENV = "AGENT_RELAY_SHARED_MCP_URL";
+
+/** Resolve the shared-listener URL: explicit runner option → env → documented default. */
+export function resolveSharedMcpUrl(explicit?: string): string {
+  return explicit ?? process.env[SHARED_MCP_URL_ENV] ?? DEFAULT_SHARED_MCP_URL;
+}
+
 export function relayMcpEndpoint(relayUrl: string): string {
   return `${relayUrl.replace(/\/+$/, "")}${RELAY_MCP_PATH}`;
 }
@@ -51,6 +69,13 @@ export function tomlString(value: string): string {
 // strict then preserves exactly that set and nothing else.
 import type { ProvisioningMcpServer } from "agent-relay-sdk";
 
+// The shared-listener bridge as a provider-neutral stdio server descriptor: a `callmux bridge`
+// child fronting the host's shared listener, with per-agent `--cwd "$WORKTREE"` for session-cwd
+// isolation (#672). It flows through the existing claude/codex stdio injection unchanged.
+export function sharedMcpBridgeServer(url: string, cwd: string): ProvisioningMcpServer {
+  return { command: "callmux", args: ["bridge", "--url", url, "--cwd", cwd] };
+}
+
 function claudeMcpServerEntry(server: ProvisioningMcpServer): Record<string, unknown> {
   const entry: Record<string, unknown> = {};
   if (server.type) entry.type = server.type;

package/src/runner-core.ts

@@ -17,7 +17,7 @@ import { ReplyObligationCache, obligationRequiresExplicitReply, responseCaptureR
 import { Outbox, type OutboxRecord } from "./outbox";
 import { extractLastAssistantTurn, extractLastAssistantTurnAfterEntry, countTranscriptEntries, extractFinalAssistantMessage, extractFinalAssistantMessageAfterEntry, extractHookAssistantMessage, extractLatestTurnSteps, stepDedupKeys, transcriptLooksComplete } from "./adapters/claude-transcript";
 import { profileUsesHostProviderGlobals } from "./profile-home";
-import { RELAY_MCP_TOKEN_ENV, relayMcpEndpoint } from "./relay-mcp";
+import { RELAY_MCP_TOKEN_ENV, relayMcpEndpoint, resolveSharedMcpUrl } from "./relay-mcp";
 import { RelayMcpProxy } from "./relay-mcp-proxy";
 import { runtimeMetadata } from "./version";
 import { logger, parseLogLevel } from "./logger";
@@ -581,6 +581,9 @@ export class AgentRunner {
       // Stage 2 (#215): the MCP endpoint the agent's client should target — the runner-local
       // proxy when active, undefined when disabled (adapters fall back to the direct relay URL).
       ...(this.mcpProxyEndpoint ? { relayMcpEndpoint: this.mcpProxyEndpoint } : {}),
+      // #672: the shared host-listener URL the `callmux bridge` connects to (env → default).
+      // Always resolved; the assembler only emits the bridge when `agentProfile.sharedMcp` is on.
+      sharedMcpUrl: resolveSharedMcpUrl(),
       monitor: {
         deliver: (messages) => this.control!.deliverToMonitor(messages),
       },