elanous 0.2.0 → 0.2.4

package/src/market/tgz.ts

@@ -0,0 +1,121 @@
+import { existsSync, lstatSync, readFileSync, readdirSync } from 'node:fs';
+import { join, posix } from 'node:path';
+import { gzipSync } from 'node:zlib';
+
+const BLOCK = 512;
+const EXCLUDED = new Set(['.git', 'node_modules', '.DS_Store']);
+const excluded = (name: string) => EXCLUDED.has(name) || name.startsWith('.env');
+
+type Entry = { path: string; source: string; executable: boolean };
+
+function tarPath(path: string): { name: string; prefix: string } {
+  if (Buffer.byteLength(path) <= 100) return { name: path, prefix: '' };
+  for (let slash = path.lastIndexOf('/', path.length - 2); slash > 0; slash = path.lastIndexOf('/', slash - 1)) {
+    const prefix = path.slice(0, slash);
+    const name = path.slice(slash + 1);
+    if (Buffer.byteLength(prefix) <= 155 && Buffer.byteLength(name) <= 100) return { name, prefix };
+  }
+  throw new Error(`tar path exceeds ustar limits: ${path}`);
+}
+
+function text(header: Buffer, offset: number, width: number, value: string): void {
+  const bytes = Buffer.from(value, 'utf8');
+  if (bytes.length > width) throw new Error(`tar field exceeds ${width} bytes: ${value}`);
+  bytes.copy(header, offset);
+}
+
+function octal(header: Buffer, offset: number, width: number, value: number): void {
+  if (!Number.isSafeInteger(value) || value < 0 || value.toString(8).length > width - 1) {
+    throw new Error(`tar numeric field exceeds ${width} bytes: ${value}`);
+  }
+  text(header, offset, width, value.toString(8).padStart(width - 1, '0'));
+}
+
+function headerFor(entry: Entry, size: number): Buffer {
+  const header = Buffer.alloc(BLOCK);
+  const { name, prefix } = tarPath(entry.path);
+  text(header, 0, 100, name);
+  octal(header, 100, 8, entry.executable ? 0o755 : 0o644);
+  octal(header, 108, 8, 0);
+  octal(header, 116, 8, 0);
+  octal(header, 124, 12, size);
+  octal(header, 136, 12, 0);
+  header.fill(0x20, 148, 156);
+  text(header, 156, 1, '0');
+  text(header, 257, 6, 'ustar');
+  text(header, 263, 2, '00');
+  text(header, 345, 155, prefix);
+  const checksum = header.reduce((sum, byte) => sum + byte, 0);
+  text(header, 148, 8, `${checksum.toString(8).padStart(6, '0')}\0 `);
+  return header;
+}
+
+/** Pack a directory as a reproducible ustar gzip archive; archive paths are relative to its root. */
+export function packDirDeterministic(dir: string, opts?: {
+  exclude?: RegExp;
+  extraDirs?: ReadonlyArray<{ from: string; as: string }>;
+}): Uint8Array {
+  const root = lstatSync(dir);
+  if (!root.isDirectory() || root.isSymbolicLink()) throw new Error(`not a directory: ${dir}`);
+  const entries: Entry[] = [];
+  function walk(source: string, relative: string, normalizeSkill?: string): void {
+    for (const name of readdirSync(source)) {
+      if (excluded(name)) continue;
+      const path = relative ? `${relative}/${name}` : name;
+      if (opts?.exclude) {
+        opts.exclude.lastIndex = 0;
+        if (opts.exclude.test(path)) continue;
+      }
+      const child = join(source, name);
+      const stat = lstatSync(child);
+      if (stat.isSymbolicLink()) throw new Error(`cannot pack symbolic link: ${path}`);
+      if (stat.isDirectory()) {
+        walk(child, path);
+      } else if (stat.isFile()) {
+        // Compare real directory entries: on a case-insensitive disk (macOS) existsSync('SKILL.md') is true for skill.md.
+        const archivePath = normalizeSkill && name === 'skill.md' && relative === normalizeSkill &&
+          !readdirSync(source).includes('SKILL.md') ? `${relative}/SKILL.md` : path;
+        entries.push({ path: archivePath, source: child, executable: (stat.mode & 0o111) !== 0 });
+      } else {
+        throw new Error(`cannot pack non-regular file: ${path}`);
+      }
+    }
+  }
+  walk(dir, '');
+  const destinations: string[] = [];
+  for (const { from, as } of opts?.extraDirs ?? []) {
+    if (!as || posix.isAbsolute(as) || as.split('/').some(part => !part || part === '.' || part === '..' || excluded(part)) || as.includes('\\')) {
+      throw new Error(`bundle-conflict: invalid destination ${as}`);
+    }
+    if (destinations.some(path => as === path || as.startsWith(`${path}/`) || path.startsWith(`${as}/`)) ||
+        existsSync(join(dir, ...as.split('/'))) ||
+        entries.some(entry => entry.path === as || entry.path.startsWith(`${as}/`) || as.startsWith(`${entry.path}/`))) {
+      throw new Error(`bundle-conflict: ${as}`);
+    }
+    const stat = lstatSync(from);
+    if (stat.isSymbolicLink() || (!stat.isDirectory() && !stat.isFile())) throw new Error(`not a directory or file: ${from}`);
+    destinations.push(as);
+    // A single file (e.g. a graph declaration) lands at exactly `as`.
+    if (stat.isFile()) entries.push({ path: as, source: from, executable: (stat.mode & 0o111) !== 0 });
+    else walk(from, as, as);
+  }
+  entries.sort((a, b) => Buffer.compare(Buffer.from(a.path), Buffer.from(b.path)));
+  for (let i = 1; i < entries.length; i++) {
+    if (entries[i]?.path === entries[i - 1]?.path) throw new Error(`bundle-conflict: ${entries[i]?.path}`);
+  }
+  const blocks: Buffer[] = [];
+  for (const entry of entries) {
+    const contents = readFileSync(entry.source);
+    blocks.push(headerFor(entry, contents.length));
+    if (contents.length) {
+      blocks.push(contents);
+      const padding = (BLOCK - (contents.length % BLOCK)) % BLOCK;
+      if (padding) blocks.push(Buffer.alloc(padding));
+    }
+  }
+  blocks.push(Buffer.alloc(BLOCK * 2));
+  const gzip = gzipSync(Buffer.concat(blocks));
+  gzip.fill(0, 4, 8);
+  gzip[9] = 255;
+  return gzip;
+}

package/src/mcp/client.ts

@@ -529,7 +529,7 @@ export interface McpClientOpts {
 
 // ─── Internal shapes ─────────────────────────────────────────────
 
-const CLIENT_INFO = { name: 'monad-agent', version: '0.1.0' };
+const CLIENT_INFO = { name: 'elanous-agent', version: '0.1.0' };
 /** MCP Apps 확장(SEP-1865 · Final)을 «우리가 실제로 하는 만큼» 선언한다.
  *
  *  ⛔⭐ `mimeTypes` 는 스펙이 «필수»로 요구한다 — 빈 객체로 선언하면

package/src/mcp/mcp-oauth.ts

@@ -27,7 +27,7 @@ import { debug } from '../debug/log.js';
 const REFRESH_BUFFER_MS = 120_000;
 const AUTH_MODE = 'mcp-oauth';
 const DEFAULT_REDIRECT_URI = 'http://127.0.0.1/oauth/callback';
-const CLIENT_NAME = 'monad-agent';
+const CLIENT_NAME = 'elanous-agent';
 
 export type McpOAuthErrorCode =
   | 'discovery'
@@ -79,6 +79,8 @@ export interface AuthorizationServerMetadata {
 export interface ClientRegistration {
   clientId: string;
   clientSecret?: string;
+  /** 동적 등록 때 쓴 redirect_uri. 옛 등록에는 없다. */
+  redirectUri?: string;
 }
 
 export interface AuthorizationRequest {
@@ -131,6 +133,8 @@ export interface McpOAuthAuthorization {
 export interface PrepareMcpOAuthAuthorizationOpts extends McpOAuthRuntimeOpts {
   resourceMetadataUrl: string;
   scope?: string;
+  /** 저장된 등록의 포트를 못 열었을 때 새 client_id 로 다시 등록한다. */
+  forceReregister?: boolean;
 }
 
 /** ⛔⭐⭐ MCP 자격은 «우주를 따라가지 않는다» — 격리 매뉴얼 §6 의 전역 사용자 자산이다.
@@ -172,6 +176,7 @@ function loadIssuerState(
       authMode: AUTH_MODE,
       ...(stranded.accountUuid ? { accountUuid: stranded.accountUuid } : {}),
       ...(stranded.organizationUuid ? { organizationUuid: stranded.organizationUuid } : {}),
+      ...(stranded.redirectUri ? { redirectUri: stranded.redirectUri } : {}),
       mirrorCodex: false,
     },
     path,
@@ -402,9 +407,11 @@ function registrationFromState(state: ProviderAuthState | null): ClientRegistrat
   const clientId = state?.accountUuid?.trim();
   if (!state || !clientId) return null;
   const clientSecret = state.organizationUuid?.trim();
+  const redirectUri = state.redirectUri?.trim();
   return {
     clientId,
     ...(clientSecret ? { clientSecret } : {}),
+    ...(redirectUri ? { redirectUri } : {}),
   };
 }
 
@@ -426,12 +433,32 @@ function persistRegistration(
         : existing?.organizationUuid
           ? { organizationUuid: existing.organizationUuid }
           : {}),
+      ...(registration.redirectUri ? { redirectUri: registration.redirectUri } : {}),
       mirrorCodex: false,
     },
     path,
   );
 }
 
+/** 루프백 redirect_uri 의 TCP 포트. 없거나 기본 포트(생략)면 null. */
+export function loopbackRedirectPort(redirectUri: string | undefined): number | null {
+  if (!redirectUri?.trim()) return null;
+  let parsed: URL;
+  try {
+    parsed = new URL(redirectUri);
+  } catch {
+    return null;
+  }
+  if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') return null;
+  if (parsed.hostname !== '127.0.0.1' && parsed.hostname !== 'localhost' && parsed.hostname !== '[::1]') {
+    return null;
+  }
+  if (!parsed.port) return null;
+  const port = Number(parsed.port);
+  if (!Number.isInteger(port) || port < 1 || port > 65535) return null;
+  return port;
+}
+
 export function loadStoredRegistration(
   issuer: string,
   opts: McpOAuthRuntimeOpts = {},
@@ -441,11 +468,14 @@ export function loadStoredRegistration(
 
 export async function ensureClientRegistration(
   metadata: AuthorizationServerMetadata,
-  opts: McpOAuthRuntimeOpts = {},
+  opts: McpOAuthRuntimeOpts & { forceReregister?: boolean } = {},
 ): Promise<ClientRegistration> {
   const path = storePath(opts);
-  const stored = loadStoredRegistration(metadata.issuer, { storePath: path });
-  if (stored) return stored;
+  if (!opts.forceReregister) {
+    const stored = loadStoredRegistration(metadata.issuer, { storePath: path });
+    // 옛 등록은 redirect_uri 기록이 없다 — 재사용하면 포트 불일치로 영원히 막힌다.
+    if (stored?.redirectUri) return stored;
+  }
   if (!metadata.registrationEndpoint) {
     throw new McpOAuthError(
       'registration',
@@ -489,6 +519,7 @@ export async function ensureClientRegistration(
   const registration: ClientRegistration = {
     clientId,
     ...(clientSecret ? { clientSecret } : {}),
+    redirectUri,
   };
   persistRegistration(metadata.issuer, registration, path);
   return registration;
@@ -642,6 +673,7 @@ function persistTokens(
       authMode: AUTH_MODE,
       ...(clientId ? { accountUuid: clientId } : {}),
       ...(clientSecret ? { organizationUuid: clientSecret } : {}),
+      ...(existing?.redirectUri ? { redirectUri: existing.redirectUri } : {}),
       mirrorCodex: false,
     },
     path,
@@ -769,7 +801,10 @@ export async function prepareMcpOAuthAuthorization(
   opts: PrepareMcpOAuthAuthorizationOpts,
 ): Promise<McpOAuthAuthorization> {
   const { resource, metadata } = await discoverMcpOAuth(opts.resourceMetadataUrl, opts);
-  const registration = await ensureClientRegistration(metadata, opts);
+  const registration = await ensureClientRegistration(metadata, {
+    ...opts,
+    ...(opts.forceReregister ? { forceReregister: true } : {}),
+  });
   const request = buildAuthorizationRequest(metadata, registration, {
     scope: opts.scope,
     resource: resource.resource,

package/src/mcp/server.ts

@@ -25,6 +25,10 @@ import { dispatchToolByName, listToolRuntimes, getToolRuntime } from '../tool-ru
 import { findNativeTool } from '../native-tool-catalog.js';
 import { debug } from '../debug/log.js';
 import { userIntentLogger } from '../user-intent/index.js';
+import { buildCliAgentTools } from '../cli/agent-cli.js';
+import { getUserConfig } from '../user-config.js';
+import type { TokenScope } from '../auth/scope.js';
+import { filterToolsForScope, isToolAllowedForScope } from '../nexus/api/mcp-public-allowlist.js';
 
 // ─── JSON-RPC shapes ─────────────────────────────────────────────
 
@@ -71,7 +75,7 @@ export function negotiateMcpProtocolVersion(
   return MCP_PROTOCOL_VERSION_LATEST;
 }
 
-const SERVER_INFO = { name: 'monad-agent', version: '0.1.0' };
+const SERVER_INFO = { name: 'elanous-agent', version: '0.1.0' };
 
 // ─── Handler ─────────────────────────────────────────────────────
 
@@ -91,6 +95,11 @@ export interface McpServerContext {
    *  Unset = emit is skipped (preserves backward-compat for any caller
    *  not yet origin-aware). */
   origin?: 'mcp-http' | 'mcp-stdio' | 'rest';
+  /** Filled from `initialize.params.clientInfo.name` on a stdio
+   *  connection; forwarded to tools as `ctx.mcpClient`. */
+  clientName?: string;
+  /** Authenticated HTTP token scope; absent on stdio and other trusted transports. */
+  tokenScope?: TokenScope;
 }
 
 /** Emit a `system.mcp.proxy_call` user-intent event for a single
@@ -130,7 +139,9 @@ export async function handleMcpRequest(
   const base = { jsonrpc: '2.0' as const, id };
   try {
     switch (req.method) {
-      case 'initialize':
+      case 'initialize': {
+        const clientInfo = req.params?.clientInfo as { name?: unknown } | undefined;
+        if (typeof clientInfo?.name === 'string' && clientInfo.name.trim()) ctx.clientName = clientInfo.name.trim().slice(0, 80);
         return {
           ...base,
           result: {
@@ -139,22 +150,30 @@ export async function handleMcpRequest(
             serverInfo: SERVER_INFO,
           },
         };
+      }
 
       case 'initialized':
       case 'notifications/initialized':
         return { ...base, result: {} };
 
       case 'tools/list': {
+        await preloadCoreTools();
         ensureDefaultMcpToolRuntimes();
         const surface = ctx.surface ?? 'mcp';
         const runtimes = listToolRuntimes(surface);
         logMcpToolsList(runtimes, surface, ctx.origin);
-        return { ...base, result: { tools: runtimes.map(runtimeToMcpTool) } };
+        const tools = runtimes.map(rt => runtimeToMcpTool(rt, surface));
+        return { ...base, result: { tools: ctx.tokenScope ? filterToolsForScope(tools, ctx.tokenScope) : tools } };
       }
 
       case 'tools/call': {
+        await preloadCoreTools();
         ensureDefaultMcpToolRuntimes();
         const name = typeof req.params?.name === 'string' ? req.params.name : '';
+        if (ctx.tokenScope && !isToolAllowedForScope(name, ctx.tokenScope)) {
+          emitProxyCallIntent(name, ctx.origin, false, 'unknown_tool');
+          return { ...base, error: { code: -32601, message: `unknown tool: ${name}` } };
+        }
         const args = (req.params?.arguments as Record<string, unknown>) ?? {};
         const surface = ctx.surface ?? 'mcp';
         const rt = getToolRuntime(name);
@@ -167,7 +186,32 @@ export async function handleMcpRequest(
           };
         }
         try {
-          const out = await dispatchToolByName(name, args, { surface });
+          const isMcpAgent = surface === 'mcp' && rt.id === 'agent';
+          const agentArgs = isMcpAgent
+            ? { ...args, run_in_background: args.run_in_background ?? true }
+            : args;
+          const agentConfig = isMcpAgent ? getUserConfig() : undefined;
+          const agentCwd = typeof args.cwd === 'string' ? args.cwd : process.cwd();
+          const agentTools = agentConfig
+            ? buildCliAgentTools(agentConfig, undefined, agentCwd)
+            : undefined;
+          const out = await dispatchToolByName(name, agentArgs, {
+            surface,
+            ...(ctx.clientName ? { mcpClient: ctx.clientName } : {}),
+            ...(agentTools ? {
+              agentHostTools: agentTools.specs,
+              agentCwd,
+              agentDispatchTool: agentTools.dispatch,
+              buildChildToolCatalog: (childCwd: string) => buildCliAgentTools(agentConfig, undefined, childCwd),
+            } : {}),
+          });
+          if (isMcpAgent && 'taskId' in out && typeof out.taskId === 'string') {
+            debug.log('mcp.agent', 'spawned', {
+              taskId: out.taskId,
+              client: ctx.clientName,
+              background: agentArgs.run_in_background === true,
+            });
+          }
           emitProxyCallIntent(name, ctx.origin, true);
           return { ...base, result: toMcpToolCallResult(out) };
         } catch (err) {
@@ -192,6 +236,13 @@ export async function handleMcpRequest(
   }
 }
 
+let preloaded: Promise<unknown> | null = null;
+
+async function preloadCoreTools(): Promise<void> {
+  preloaded ??= import('../domains/core-tools.js').catch(() => {});
+  await preloaded;
+}
+
 /** Ensure direct MCP transports expose elanous-owned runtimes even before
  * the daemon's broader boot sequence has registered them. Registration is
  * idempotent, so externally registered proxy runtimes remain untouched. */
@@ -221,11 +272,28 @@ function logMcpToolsList(
   } catch { /* observability must not break JSON-RPC */ }
 }
 
-function runtimeToMcpTool(rt: ToolRuntime): Record<string, unknown> {
+function runtimeToMcpTool(rt: ToolRuntime, surface: ToolSurface) {
+  const inputSchema = surface === 'mcp' && rt.id === 'agent'
+    ? {
+        ...rt.spec.parameters,
+        properties: {
+          ...(rt.spec.parameters.properties as Record<string, unknown>),
+          cwd: {
+            type: 'string',
+            description: 'Optional MCP working directory for the child. Defaults to the MCP server process cwd.',
+          },
+        },
+      }
+    : rt.spec.parameters;
+  // Over MCP the agent tool runs in the background unless the caller says otherwise (client tool
+  // timeouts are short) — say so in the description the MCP client shows its model (#21088 review).
+  const description = surface === 'mcp' && rt.id === 'agent'
+    ? `${rt.spec.description} Over MCP this returns immediately with a taskId (run_in_background defaults to true); collect the result with AgentOutput(taskId, block: true) and cancel with AgentStop(taskId). Pass cwd to run the child in a specific project folder.`
+    : rt.spec.description;
   return {
     name: rt.spec.name,
-    description: rt.spec.description,
-    inputSchema: rt.spec.parameters,
+    description,
+    inputSchema,
   };
 }
 

package/src/mcp-gateway/gateway.ts

@@ -0,0 +1,128 @@
+import { debug } from '../debug/log.js';
+import { matchMcpPat } from './pat-store.js';
+
+const MAX_BODY = 1024 * 1024;
+const MAX_IP_BUCKETS = 4096;
+
+export class MinuteIpLimiter {
+  private readonly buckets = new Map<string, number>();
+  private minute: number | undefined;
+
+  constructor(private readonly limit: number, private readonly maxBuckets = MAX_IP_BUCKETS) {}
+
+  allow(ip: string, minute: number): boolean {
+    if (this.minute !== minute) {
+      this.buckets.clear();
+      this.minute = minute;
+    }
+    const count = this.buckets.get(ip);
+    if (count === undefined && this.buckets.size >= this.maxBuckets) return false;
+    if (count !== undefined && count >= this.limit) return false;
+    this.buckets.set(ip, (count ?? 0) + 1);
+    return true;
+  }
+
+  get size(): number { return this.buckets.size; }
+}
+
+export interface McpGatewayOptions {
+  host: string;
+  port: number;
+  nexusUrl: string;
+  nexusToken: string;
+  patRoot: string;
+  rateLimitPerMinute?: number;
+  publicUrl: string;
+}
+
+export function startMcpGateway(options: McpGatewayOptions): ReturnType<typeof Bun.serve> {
+  if (!options.publicUrl) throw new Error('public URL required');
+  const base = new URL(options.publicUrl);
+  if (!['http:', 'https:'].includes(base.protocol) || base.username || base.password || base.search || base.hash || base.pathname !== '/' || ['0.0.0.0', '[::]'].includes(base.hostname)) throw new Error('invalid public URL');
+  const nexus = new URL(options.nexusUrl);
+  if (!['http:', 'https:'].includes(nexus.protocol) || nexus.username || nexus.password || nexus.search || nexus.hash || nexus.pathname !== '/') throw new Error('invalid nexus URL');
+  if (!options.nexusToken || /\s/.test(options.nexusToken)) throw new Error('invalid nexus token');
+  const limit = options.rateLimitPerMinute ?? 60;
+  if (!Number.isSafeInteger(limit) || limit <= 0) throw new Error('invalid rate limit');
+  const resource = base.origin;
+  const challenge = `Bearer resource_metadata="${resource}/.well-known/oauth-protected-resource"`;
+  const counts = new Map<string, { minute: number; count: number }>();
+  const ipLimiter = new MinuteIpLimiter(Math.max(limit, 60));
+  return Bun.serve({
+    hostname: options.host,
+    port: options.port,
+    async fetch(req, server): Promise<Response> {
+      const url = new URL(req.url);
+      if (url.pathname !== '/mcp' && url.pathname !== '/.well-known/oauth-protected-resource') return new Response(null, { status: 404 });
+      if (req.headers.has('origin')) return new Response(null, { status: 403 });
+      if (url.pathname === '/.well-known/oauth-protected-resource' && req.method === 'GET' && !url.search) {
+        return Response.json({ resource, bearer_methods_supported: ['header'], authorization_servers: [] });
+      }
+      if (url.pathname !== '/mcp' || req.method !== 'POST' || url.search) return new Response(null, { status: 404 });
+      const minute = Math.floor(Date.now() / 60_000);
+      const ip = server.requestIP(req)?.address ?? 'unknown';
+      if (!ipLimiter.allow(ip, minute)) return new Response(null, { status: 429 });
+      const auth = /^Bearer ([A-Za-z0-9_-]+)$/.exec(req.headers.get('authorization') ?? '');
+      let pat = null;
+      try { if (auth) pat = matchMcpPat(auth[1]!, Date.now(), options.patRoot); }
+      catch { /* inaccessible/corrupt store denies access */ }
+      if (!pat) return new Response(null, { status: 401, headers: { 'www-authenticate': challenge } });
+      const started = Date.now();
+      let status = 502;
+      let method = 'unknown';
+      let tool: string | undefined;
+      try {
+        const bucket = counts.get(pat.name);
+        const count = bucket?.minute === minute ? bucket.count + 1 : 1;
+        counts.set(pat.name, { minute, count });
+        if (count > limit) { status = 429; return new Response(null, { status }); }
+        const declared = Number(req.headers.get('content-length'));
+        if (req.headers.has('content-length') && Number.isFinite(declared) && declared > MAX_BODY) { status = 413; return new Response(null, { status }); }
+        const reader = req.body?.getReader();
+        const chunks: Uint8Array[] = [];
+        let length = 0;
+        if (reader) {
+          try {
+            for (;;) {
+              const { done, value } = await reader.read();
+              if (done) break;
+              length += value.byteLength;
+              if (length > MAX_BODY) { await reader.cancel(); status = 413; return new Response(null, { status }); }
+              chunks.push(value);
+            }
+          } finally { reader.releaseLock(); }
+        }
+        const body = Buffer.concat(chunks.map((chunk) => Buffer.from(chunk)), length);
+        try {
+          const rpc: unknown = JSON.parse(body.toString('utf8'));
+          if (rpc && typeof rpc === 'object' && !Array.isArray(rpc)) {
+            const record = rpc as { method?: unknown; params?: { name?: unknown } };
+            if (typeof record.method === 'string') method = record.method;
+            if (method === 'tools/call' && typeof record.params?.name === 'string') tool = record.params.name;
+          }
+        } catch { /* The nexus owns JSON-RPC validation. */ }
+        const headers = new Headers();
+        for (const key of ['content-type', 'accept', 'mcp-session-id', 'mcp-protocol-version', 'mcp-progress']) {
+          const value = req.headers.get(key);
+          if (value !== null) headers.set(key, value);
+        }
+        headers.set('authorization', `Bearer ${options.nexusToken}`);
+        // Force the nexus to authenticate its scoped token even over a loopback connection.
+        headers.set('x-forwarded-for', 'mcp-gateway');
+        const upstream = await fetch(new URL('/v1/mcp', nexus), { method: 'POST', headers, body, redirect: 'manual' });
+        if (upstream.status >= 300 && upstream.status < 400) { status = 502; await upstream.body?.cancel(); return new Response(null, { status }); }
+        status = upstream.status;
+        // fetch 는 압축 응답을 풀어서 준다 — 원래의 content-encoding·content-length 를 그대로 붙이면 본문과 어긋나 MCP 응답이 깨진다(리뷰 must-fix · #21457).
+        const outHeaders = new Headers(upstream.headers);
+        outHeaders.delete('content-encoding');
+        outHeaders.delete('content-length');
+        return new Response(upstream.body, { status, headers: outHeaders });
+      } catch {
+        status = 502;
+        return new Response(null, { status });
+      } finally {
+        debug.log('mcp.gateway', 'call', { tokenName: pat.name, method, ...(tool === undefined ? {} : { tool }), status, ms: Date.now() - started });
+      }
+    },
+  });
+}

package/src/mcp-gateway/pat-store.ts

@@ -0,0 +1,124 @@
+import { createHash, randomBytes, timingSafeEqual } from 'node:crypto';
+import { closeSync, constants, fstatSync, lstatSync, mkdirSync, openSync, readFileSync, renameSync, unlinkSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { dlopen, FFIType } from 'bun:ffi';
+import { effectiveInstanceRoot } from '../instance/resolve.js';
+
+type PatInfo = { name: string; createdAt: string; expiresAt: string | null };
+type StoredPat = PatInfo & { hash: string };
+const NAME = /^[a-zA-Z0-9][a-zA-Z0-9._-]{0,63}$/;
+const HASH = /^[a-f0-9]{64}$/;
+const directory = (root: string) => join(root, 'mcp-gateway');
+const file = (root: string) => join(directory(root), 'pats.json');
+
+function read(root: string): StoredPat[] {
+  let raw: string;
+  try {
+    const stat = lstatSync(file(root));
+    if (!stat.isFile() || (stat.mode & 0o077) !== 0) throw new Error('PAT store must be a private regular file');
+    raw = readFileSync(file(root), 'utf8');
+  } catch (error) {
+    if ((error as NodeJS.ErrnoException).code === 'ENOENT') return [];
+    throw error;
+  }
+  const value: unknown = JSON.parse(raw);
+  if (!value || typeof value !== 'object' || Array.isArray(value) || Object.keys(value).length !== 1 || !('tokens' in value) || !Array.isArray(value.tokens)
+    || !value.tokens.every((row: unknown) => row && typeof row === 'object' && !Array.isArray(row) && Object.keys(row).length === 4
+      && 'name' in row && typeof row.name === 'string' && NAME.test(row.name)
+      && 'hash' in row && typeof row.hash === 'string' && HASH.test(row.hash)
+      && 'createdAt' in row && typeof row.createdAt === 'string' && Number.isFinite(Date.parse(row.createdAt))
+      && 'expiresAt' in row && (row.expiresAt === null || (typeof row.expiresAt === 'string' && Number.isFinite(Date.parse(row.expiresAt)))))) {
+    throw new Error('invalid PAT store');
+  }
+  const tokens = value.tokens as StoredPat[];
+  if (new Set(tokens.map((row) => row.name)).size !== tokens.length) throw new Error('duplicate PAT names');
+  return tokens;
+}
+
+function locked<T>(root: string, action: () => T): T {
+  mkdirSync(directory(root), { recursive: true, mode: 0o700 });
+  const fd = openSync(join(directory(root), '.pats.lock'), constants.O_CREAT | constants.O_RDWR | constants.O_NOFOLLOW, 0o600);
+  let lib: ReturnType<typeof dlopen> | undefined;
+  let flock: ((fd: number, op: number) => number) | undefined;
+  let acquired = false;
+  try {
+    const stat = fstatSync(fd);
+    if (!stat.isFile() || (stat.mode & 0o077) !== 0) throw new Error('PAT lock must be private');
+    const libc = process.platform === 'darwin' ? '/usr/lib/libSystem.B.dylib' : process.platform === 'linux' ? 'libc.so.6' : null;
+    if (!libc) throw new Error('PAT locking unavailable on this platform');
+    lib = dlopen(libc, { flock: { args: [FFIType.i32, FFIType.i32], returns: FFIType.i32 } });
+    flock = (fd, op) => (lib!.symbols.flock as unknown as (fd: number, op: number) => number)(fd, op);
+    const deadline = Date.now() + 10_000;
+    const pause = new Int32Array(new SharedArrayBuffer(4));
+    while (flock(fd, 2 | 4) !== 0) {
+      if (Date.now() >= deadline) throw new Error('timed out waiting for PAT lock');
+      Atomics.wait(pause, 0, 0, 10);
+    }
+    acquired = true;
+    return action();
+  } finally {
+    if (acquired) flock!(fd, 8);
+    closeSync(fd);
+    lib?.close();
+  }
+}
+
+function write(root: string, tokens: StoredPat[]): void {
+  try {
+    const stat = lstatSync(file(root));
+    if (!stat.isFile() || (stat.mode & 0o077) !== 0) throw new Error('PAT store must be private');
+  } catch (error) {
+    if ((error as NodeJS.ErrnoException).code !== 'ENOENT') throw error;
+  }
+  const temporary = join(directory(root), `.pats-${randomBytes(16).toString('hex')}.tmp`);
+  const fd = openSync(temporary, 'wx', 0o600);
+  try {
+    try { writeFileSync(fd, JSON.stringify({ tokens }, null, 2) + '\n'); }
+    finally { closeSync(fd); }
+    renameSync(temporary, file(root));
+  } catch (error) {
+    try { unlinkSync(temporary); } catch { /* already renamed */ }
+    throw error;
+  }
+}
+
+export function issueMcpPat(name: string, options: { expiresDays?: number } = {}, root: string = effectiveInstanceRoot()): PatInfo & { token: string } {
+  if (!NAME.test(name)) throw new Error('invalid PAT name');
+  const days = options.expiresDays;
+  if (days !== undefined && (!Number.isSafeInteger(days) || days <= 0 || Date.now() + days * 86_400_000 > 8.64e15)) throw new Error('invalid PAT expiration');
+  return locked(root, () => {
+    const tokens = read(root);
+    if (tokens.some((row) => row.name === name)) throw new Error('PAT name already exists');
+    const token = randomBytes(32).toString('base64url');
+    const createdAt = new Date().toISOString();
+    const expiresAt = days === undefined ? null : new Date(Date.now() + days * 86_400_000).toISOString();
+    write(root, [...tokens, { name, hash: createHash('sha256').update(token).digest('hex'), createdAt, expiresAt }]);
+    return { name, token, createdAt, expiresAt };
+  });
+}
+
+export function listMcpPats(root: string = effectiveInstanceRoot()): PatInfo[] {
+  return read(root).map(({ name, createdAt, expiresAt }) => ({ name, createdAt, expiresAt }));
+}
+
+export function revokeMcpPat(name: string, root: string = effectiveInstanceRoot()): boolean {
+  return locked(root, () => {
+    const tokens = read(root);
+    const remaining = tokens.filter((row) => row.name !== name);
+    if (remaining.length === tokens.length) return false;
+    write(root, remaining);
+    return true;
+  });
+}
+
+export function matchMcpPat(token: string, now: number = Date.now(), root: string = effectiveInstanceRoot()): PatInfo | null {
+  if (typeof token !== 'string' || !token) return null;
+  const digest = createHash('sha256').update(token).digest();
+  let found: PatInfo | null = null;
+  for (const row of read(root)) {
+    if (timingSafeEqual(digest, Buffer.from(row.hash, 'hex')) && (row.expiresAt === null || Date.parse(row.expiresAt) > now)) {
+      found = { name: row.name, createdAt: row.createdAt, expiresAt: row.expiresAt };
+    }
+  }
+  return found;
+}