robodev 0.52.0 → 0.53.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "robodev",
-  "version": "0.52.0",
+  "version": "0.53.0",
   "description": "CLI for Robodev Starbase — create, auth, link, deploy, load, and run a project locally with robodev dev",
   "type": "module",
   "license": "MIT",
@@ -26,8 +26,8 @@
     "embedded-postgres": "17.10.0-beta.17",
     "fastify": "^5.12.1",
     "tsx": "^4.20.5",
-    "@robodev-ai/runtime": "0.12.0",
-    "@robodev-ai/sdk": "0.16.0"
+    "@robodev-ai/runtime": "0.13.0",
+    "@robodev-ai/sdk": "0.17.0"
   },
   "devDependencies": {
     "@types/node": "^24.3.0",

package/src/collect-files.test.ts

@@ -8,6 +8,7 @@ import {
   collectFiles,
   collectSourceFiles,
   mergeCollectedFiles,
+  mixedBackendLayoutError,
   shouldCollectPath,
   shouldCollectSourcePath,
 } from "./collect-files.js";
@@ -221,3 +222,13 @@ test("backend tests are not collected for deploy", () => {
   assert.equal(shouldCollectPath("robodev/api/_lib.ts"), true);
   assert.equal(shouldCollectPath("robodev/api/latest.ts"), true);
 });
+
+test("robodev/mcp.ts (defineMcp) is collected beside the mcp/ tools directory", () => {
+  assert.equal(shouldCollectPath("robodev/mcp.ts"), true);
+  assert.equal(shouldCollectPath("robodev/mcp/ping.ts"), true);
+  assert.equal(shouldCollectPath("mcp.ts"), true);
+  assert.equal(shouldCollectPath("robodev/mcp.js"), false);
+  assert.ok(mixedBackendLayoutError(["robodev/database.ts", "mcp.ts"]));
+  assert.ok(mixedBackendLayoutError(["database.ts", "robodev/mcp.ts"]));
+  assert.equal(mixedBackendLayoutError(["robodev/database.ts", "robodev/mcp.ts"]), null);
+});

package/src/collect-files.ts

@@ -145,6 +145,8 @@ function isBackendPath(path: string): boolean {
   if (inner === "database.ts" && (path === "database.ts" || path === "robodev/database.ts")) {
     return true;
   }
+  // `defineMcp` settings; exactly `mcp.ts`, never a tool under `mcp/`.
+  if (path === "mcp.ts" || path === "robodev/mcp.ts") return true;
   if (
     inner.startsWith("api/") ||
     inner.startsWith("jobs/") ||
@@ -180,14 +182,16 @@ export function mixedBackendLayoutError(paths: Iterable<string>): string | null
       path.startsWith("api/") ||
       path.startsWith("jobs/") ||
       path.startsWith("sockets/") ||
-      path.startsWith("mcp/"),
+      path.startsWith("mcp/") ||
+      path === "mcp.ts",
   );
   const hasNewApiJobs = list.some(
     (path) =>
       path.startsWith("robodev/api/") ||
       path.startsWith("robodev/jobs/") ||
       path.startsWith("robodev/sockets/") ||
-      path.startsWith("robodev/mcp/"),
+      path.startsWith("robodev/mcp/") ||
+      path === "robodev/mcp.ts",
   );
   if (hasNewDb && (hasLegacyDb || hasLegacyApiJobs)) {
     return "Do not mix robodev/ backend files with root database.ts, api/, or jobs/";

package/src/dev-inspect.test.ts

@@ -441,6 +441,6 @@ test("dashboard links the MCP endpoint only when the project has tools", async (
     inspect: createDevInspect(),
     runtime: { ...runtime, mcpTools: [{ name: "get_planets" }] },
   });
-  assert.equal(withTools.overview.links.mcp, "/_robodev/mcp");
-  assert.equal(isHistogramExcludedPath("/_robodev/mcp"), true);
+  assert.equal(withTools.overview.links.mcp, "/mcp");
+  assert.equal(isHistogramExcludedPath("/mcp"), true);
 });

package/src/dev-inspect.ts

@@ -42,7 +42,7 @@ const HISTOGRAM_EXCLUDED_PATHS = new Set([
   "/openapi.json",
   "/robodev-enterprise-spec.json",
   "/_robodev/ready",
-  "/_robodev/mcp",
+  "/mcp",
 ]);
 
 export const RESERVED_AUTH_ROUTES: Array<{ method: string; path: string; file: string }> = [
@@ -611,7 +611,7 @@ export async function buildDashboardState(input: {
         scalar: "/_robodev/scalar",
         openapi: "/openapi.json",
         enterprise: "/robodev-enterprise-spec.json",
-        ...(input.runtime?.mcpTools?.length ? { mcp: "/_robodev/mcp" } : {}),
+        ...(input.runtime?.mcpTools?.length ? { mcp: "/mcp" } : {}),
       },
     },
     routes,

package/src/dev-project.test.ts

@@ -64,6 +64,9 @@ test("isBackendDevPath accepts backend sources only", () => {
   assert.equal(isBackendDevPath("jobs/digest.ts"), true);
   assert.equal(isBackendDevPath("hooks/auth.ts"), true);
   assert.equal(isBackendDevPath("sockets/chat.ts"), true);
+  assert.equal(isBackendDevPath("mcp.ts"), true);
+  assert.equal(isBackendDevPath("mcp/ping.ts"), true);
+  assert.equal(isBackendDevPath("other.ts"), false);
   assert.equal(isBackendDevPath("src/main.tsx"), false);
   assert.equal(isBackendDevPath("api/planets.js"), false);
   assert.equal(isBackendDevPath("package.json"), false);

package/src/dev-project.ts

@@ -69,7 +69,7 @@ export function isBackendDevPath(path: string): boolean {
   const normalized = path.replaceAll("\\", "/");
   if (normalized.includes("..")) return false;
   if (isBackendTestPath(normalized)) return false;
-  if (normalized === "database.ts") return true;
+  if (normalized === "database.ts" || normalized === "mcp.ts") return true;
   if (!normalized.endsWith(".ts")) return false;
   const top = normalized.split("/")[0] ?? "";
   return (BACKEND_DIRS as readonly string[]).includes(top);
@@ -112,6 +112,10 @@ export async function collectBackendFiles(backendDir: string): Promise<DevFile[]
       content: await readFile(join(backendDir, "database.ts"), "utf8"),
     });
   }
+  // `defineMcp` settings sit beside the `mcp/` tools directory.
+  if (await isFile(join(backendDir, "mcp.ts"))) {
+    files.push({ path: "mcp.ts", content: await readFile(join(backendDir, "mcp.ts"), "utf8") });
+  }
   for (const name of BACKEND_DIRS) {
     await walk(join(backendDir, name));
   }

package/src/dev-server.ts

@@ -17,8 +17,10 @@ import {
   handleProjectMcpHttp,
   handleProjectOAuth,
   isLocalAuthPath,
-  isProjectMcpPath,
+  isProjectMcpRequest,
   isProjectOAuthRequestPath,
+  PROJECT_MCP_PATH,
+  resolveConsentUrl,
   localPasswordSignIn,
   localPasswordSignUp,
   authenticateProjectMcpToken,
@@ -32,6 +34,7 @@ import {
   type McpCaller,
   type OAuthHttpResponse,
   type ProjectMcpHttpResponse,
+  type RuntimeMcpConfig,
   type RuntimeMcpTool,
   isReservedStoragePath,
   ENTERPRISE_SPEC_PATH,
@@ -73,6 +76,8 @@ export type DevRuntime = {
   jobs: RuntimeJob[];
   sockets: RuntimeSocket[];
   mcpTools: RuntimeMcpTool[];
+  /** `robodev/mcp.ts` (`defineMcp`). */
+  mcpConfig?: RuntimeMcpConfig;
   openapi: Record<string, unknown>;
 };
 
@@ -107,7 +112,7 @@ export function buildDevOpenApi(
 
 /** The URL MCP clients connect to, printed in the banner. */
 export function devMcpUrl(listenOrigin: string): string {
-  return `${listenOrigin}/_robodev/mcp`;
+  return `${listenOrigin}${PROJECT_MCP_PATH}`;
 }
 
 function devOAuthSecret(options: DevServerOptions): string {
@@ -716,7 +721,14 @@ export async function startDevServer(
         return;
       }
 
-      if (isProjectMcpPath(pathname)) {
+      // A browser opening /mcp falls through to the normal 404 (the FE runs on its own dev server).
+      if (
+        isProjectMcpRequest(
+          pathname,
+          request.method,
+          request.headers as Record<string, string | string[] | undefined>,
+        )
+      ) {
         const headers = request.headers as Record<string, string | string[] | undefined>;
         const clients = () => routeClients(options, getRuntime);
         const response = await handleProjectMcpHttp(
@@ -798,6 +810,7 @@ export async function startDevServer(
             projectName: options.projectName ?? "robodev dev",
             origin: options.listenOrigin,
             secret: devOAuthSecret(options),
+            consentUrl: resolveConsentUrl(runtime.mcpConfig?.consentUrl, options.listenOrigin),
             settings: devOAuthSettings(options),
             signIn: (input) => localPasswordSignIn(runtime.pool, input),
             signUp: (input) => localPasswordSignUp(runtime.pool, input),

package/src/dev.ts

@@ -233,6 +233,8 @@ export async function main(args: string[]): Promise<void> {
     const loaded = await loadModules(distDir, files, undefined, {
       mode: "deploy",
       onWarning: (message) => log(`Warning: ${message}`),
+      // Locally the consent page may be the Vite dev server on http://localhost.
+      allowLocalConsentUrl: true,
     });
     assertJobCrons(loaded.jobs, { mode: "deploy" });
     // Any edit to database.ts can change columns, not just tables, so compare its source.
@@ -268,6 +270,7 @@ export async function main(args: string[]): Promise<void> {
       jobs: loaded.jobs,
       sockets: loaded.sockets,
       mcpTools: loaded.mcpTools,
+      ...(loaded.mcpConfig ? { mcpConfig: loaded.mcpConfig } : {}),
       openapi: buildDevOpenApi(loaded.database.name, loaded.routes, loaded.mcpTools),
     };
     projectName = loaded.database.name;
@@ -293,6 +296,9 @@ export async function main(args: string[]): Promise<void> {
     for (const tool of loaded.mcpTools) {
       log(`  MCP ${tool.name}`);
     }
+    if (loaded.mcpConfig?.consentUrl) {
+      log(`  MCP consent page ${loaded.mcpConfig.consentUrl}`);
+    }
     if (previous) {
       await previous.pool.end().catch(() => undefined);
     }

package/templates/auth-chat/package.json

@@ -9,10 +9,10 @@
     "rules:gen": "rulesync generate"
   },
   "dependencies": {
-    "@robodev-ai/sdk": "^0.16.0"
+    "@robodev-ai/sdk": "^0.17.0"
   },
   "devDependencies": {
-    "robodev": "^0.52.0",
+    "robodev": "^0.53.0",
     "rulesync": "^8.18.0",
     "typescript": "^5.9.2"
   }

package/templates/backend/package.json

@@ -8,10 +8,10 @@
     "deploy": "robodev deploy"
   },
   "dependencies": {
-    "@robodev-ai/sdk": "^0.16.0"
+    "@robodev-ai/sdk": "^0.17.0"
   },
   "devDependencies": {
-    "robodev": "^0.52.0",
+    "robodev": "^0.53.0",
     "typescript": "^5.9.2"
   }
 }

package/templates/empty/package.json

@@ -10,13 +10,13 @@
     "build": "vite build"
   },
   "dependencies": {
-    "@robodev-ai/sdk": "^0.16.0",
-    "@robodev-ai/client": "^0.5.0",
+    "@robodev-ai/sdk": "^0.17.0",
+    "@robodev-ai/client": "^0.6.0",
     "react": "^18.3.1",
     "react-dom": "^18.3.1"
   },
   "devDependencies": {
-    "robodev": "^0.52.0",
+    "robodev": "^0.53.0",
     "typescript": "^5.9.2",
     "vite": "^6.0.0"
   }

package/templates/marketplace/package.json

@@ -9,10 +9,10 @@
     "rules:gen": "rulesync generate"
   },
   "dependencies": {
-    "@robodev-ai/sdk": "^0.16.0"
+    "@robodev-ai/sdk": "^0.17.0"
   },
   "devDependencies": {
-    "robodev": "^0.52.0",
+    "robodev": "^0.53.0",
     "rulesync": "^8.18.0",
     "typescript": "^5.9.2"
   }

package/templates/povio/package.json

@@ -9,10 +9,10 @@
     "rules:gen": "rulesync generate"
   },
   "dependencies": {
-    "@robodev-ai/sdk": "^0.16.0"
+    "@robodev-ai/sdk": "^0.17.0"
   },
   "devDependencies": {
-    "robodev": "^0.52.0",
+    "robodev": "^0.53.0",
     "rulesync": "^8.18.0",
     "typescript": "^5.9.2"
   }

package/templates/shadcn/package.json

@@ -11,8 +11,8 @@
     "generate:api": "orval"
   },
   "dependencies": {
-    "@robodev-ai/sdk": "^0.16.0",
-    "@robodev-ai/client": "^0.5.0",
+    "@robodev-ai/sdk": "^0.17.0",
+    "@robodev-ai/client": "^0.6.0",
     "react": "^18.3.1",
     "react-dom": "^18.3.1",
     "react-router-dom": "^6.30.1"
@@ -21,7 +21,7 @@
     "@types/react": "^18.3.12",
     "@types/react-dom": "^18.3.1",
     "orval": "^7.11.2",
-    "robodev": "^0.52.0",
+    "robodev": "^0.53.0",
     "typescript": "^5.9.2",
     "vite": "^6.0.0"
   }

package/templates/space/package.json

@@ -9,10 +9,10 @@
     "rules:gen": "rulesync generate"
   },
   "dependencies": {
-    "@robodev-ai/sdk": "^0.16.0"
+    "@robodev-ai/sdk": "^0.17.0"
   },
   "devDependencies": {
-    "robodev": "^0.52.0",
+    "robodev": "^0.53.0",
     "rulesync": "^8.18.0",
     "typescript": "^5.9.2"
   }