snulbug 0.2.0__tar.gz → 0.2.2__tar.gz

{snulbug-0.2.0 → snulbug-0.2.2}/CHANGELOG.md

@@ -6,6 +6,35 @@ The format is based on Keep a Changelog, and this project follows semantic versi
 
 ## [Unreleased]
 
+## [0.2.2] - 2026-10-16
+
+Support always-on MCP bots with renewable automation invites, without introducing
+a separate permission or approval system.
+
+- Added renewable automation invites using the existing backing lease, with bounded consumer renewal/restart recovery, rotating access tokens, identity bindings, persistent usage budgets, and console/CLI setup snippets.
+- Serialized lease mutations across local workers so renewal, revocation, cleanup, and concurrent call consumption cannot overwrite each other's state.
+- Added renewal visibility and refresh-stable invite forms in the web console, secret-safe renewal audit events, and share closeout that revokes invites as well as the session lease.
+
+Automation renewal is opt-in. Access leases remain short-lived; the owner's
+renewal authorization has a separate hard expiry. Clients must adopt refreshed
+lease headers, and revocation or exhausted budgets prevent recovery. No change
+to the default MCP protocol version or the experimental profile's limitations.
+
+## [0.2.1] - 2026-10-15
+
+Expose web applications and APIs alongside MCP through one gateway and ngrok tunnel.
+
+- Added `[[mcp.proxy.http_routes]]` mounts with longest-prefix routing, segment-boundary matching, configurable prefix stripping, and reserved MCP/gateway paths.
+- Added repeatable `--http-route PREFIX=URL` flags to share creation and quickstart, with matching ngrok Traffic Policy rules that apply MCP edge checks only to the MCP endpoint.
+- Added streaming HTTP uploads, responses, and SSE with disconnect cleanup, ordinary HTTP headers/cookies/content encodings, and plain HTTP upstream errors; included local proxy/facade regression coverage and setup documentation.
+- Raised the PyJWT minimum to 2.15 and updated the lockfile to exclude the versions flagged by the current JWT security advisories.
+
+HTTP mounts bypass MCP authentication, leases, Lua, redaction, and MCP evidence
+logging; each backend owns its authentication. Applications must configure their
+public base path. WebSockets and rewriting HTML, redirects, or cookie paths are
+outside this slice. See [shared HTTP routes](docs/mcp-proxy.md#shared-http-routes)
+and the [ngrok walkthrough](docs/ngrok-end-to-end.md).
+
 ## [0.2.0] - 2026-09-06
 
 This release expands MCP protocol support while keeping **2025-11-25 as the default**.

{snulbug-0.2.0 → snulbug-0.2.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: snulbug
-Version: 0.2.0
+Version: 0.2.2
 Summary: A local-dev MCP policy proxy with Lua policies, replay logs, and learned least-privilege bundles
 Project-URL: Homepage, https://github.com/nahuaque/snulbug
 Project-URL: Repository, https://github.com/nahuaque/snulbug
@@ -26,7 +26,7 @@ Requires-Python: >=3.10
 Requires-Dist: httpx<1,>=0.28
 Requires-Dist: jsonschema<5,>=4.23
 Requires-Dist: lupa>=2.5
-Requires-Dist: pyjwt[crypto]>=2.8
+Requires-Dist: pyjwt[crypto]>=2.15
 Requires-Dist: referencing<1,>=0.35
 Requires-Dist: rich>=15.0.0
 Requires-Dist: tomli>=2.0; python_version < '3.11'
@@ -63,6 +63,8 @@ It gives you a tight loop for agent-tool safety:
 - review MCP-native capability requests and approve them into normal task leases
 - use task-scoped leases for temporary tool/path grants, optionally bound to
   OAuth subject, tenant, client, group, issuer, or auth profile
+- give always-on bots [renewable automation invites](docs/mcp-share.md#renewable-automation-invites)
+  with short-lived leases, consumer renewal, and restart recovery
 - turn OAuth identity into MCP-specific tool permissions
 - pin facade upstream identity with signed manifests
 

{snulbug-0.2.0 → snulbug-0.2.2}/README.md

@@ -20,6 +20,8 @@ It gives you a tight loop for agent-tool safety:
 - review MCP-native capability requests and approve them into normal task leases
 - use task-scoped leases for temporary tool/path grants, optionally bound to
   OAuth subject, tenant, client, group, issuer, or auth profile
+- give always-on bots [renewable automation invites](docs/mcp-share.md#renewable-automation-invites)
+  with short-lived leases, consumer renewal, and restart recovery
 - turn OAuth identity into MCP-specific tool permissions
 - pin facade upstream identity with signed manifests
 

{snulbug-0.2.0 → snulbug-0.2.2}/SECURITY.md

@@ -59,6 +59,16 @@ Limits:
   schemas pass through unless your Lua policy blocks them separately.
 - Leases are bearer-style capabilities. Store `leases.json` locally, rotate or
   revoke leases after sharing, and prefer short TTLs for public tunnel use.
+- Renewable automation invites add a separate, reusable renewal credential with
+  an owner-set hard deadline. Treat it as a long-lived bot secret: theft together
+  with the required gateway authentication permits recovery within the approved
+  capability and call-budget bounds until revocation or expiry. It does not
+  grant console access. Renewal retains the existing lease's usage count and
+  identity bindings; revocation disables recovery. Access-token rotation has a
+  bounded overlap of at most 30 seconds. Lease operations are serialized on the
+  local lease file; independent gateway hosts must not treat copied JSON stores
+  as a shared revocation authority. The owner console's invite secret store
+  contains plaintext setup credentials and must remain private.
 
 ### Malicious or compromised MCP server
 

{snulbug-0.2.0 → snulbug-0.2.2}/docs/devcontainers.md

@@ -10,8 +10,8 @@ servers with a shared control plane.
 ```json
 {
   "features": {
-    "ghcr.io/nahuaque/snulbug/features/snulbug:0.2.0": {
-      "version": "0.2.0",
+    "ghcr.io/nahuaque/snulbug/features/snulbug:0.2.2": {
+      "version": "0.2.2",
       "mode": "member-agent",
       "policy_profile": "tunnel-safe",
       "registry": "redis://redis:6379/0",

{snulbug-0.2.0 → snulbug-0.2.2}/docs/mcp-proxy.md

@@ -109,6 +109,68 @@ curl -sS "${NGROK_URL}/mcp" \
   -d '{"jsonrpc":"2.0","id":"tools-list","method":"tools/list","params":{}}'
 ```
 
+## Shared HTTP Routes
+
+One gateway listener can expose MCP at `/mcp` and ordinary HTTP backends at
+other prefixes. Add mounts to the share's `snulbug.toml`:
+
+```toml
+[[mcp.proxy.http_routes]]
+prefix = "/app"
+upstream = "http://127.0.0.1:3000"
+strip_prefix = true
+
+[[mcp.proxy.http_routes]]
+prefix = "/api"
+upstream = "http://127.0.0.1:4000"
+strip_prefix = false
+```
+
+With prefix stripping (the default), `/app/notes?q=1` forwards to
+`http://127.0.0.1:3000/notes?q=1`. With `strip_prefix = false`, `/api/items`
+forwards to `http://127.0.0.1:4000/api/items`. A path in the upstream URL is
+prepended to the forwarded path. Prefix matches use segment boundaries:
+`/app` matches `/app` and `/app/...`, but not `/application`. The longest
+matching prefix wins. The MCP prefix, `/.well-known`, and `/snulbug` are reserved.
+
+These requests bypass the MCP middleware, including its authentication, task
+leases, Lua policies, body/response limits, redaction, and replay/audit logs.
+Each HTTP backend owns authentication and request validation. Application
+`Authorization` and cookies pass through; snulbug lease and internal headers
+are removed. Responses preserve status, content encoding, duplicate cookies,
+and end-to-end headers. Uploads and responses stream with backpressure and
+disconnect cleanup; the proxy timeout applies to upstream inactivity.
+
+Configure web applications to generate assets, redirects, and cookies for their
+public prefix (for example `/app/`), using their base URL/root-path setting or
+the forwarded host, protocol, and prefix headers. Snulbug does not rewrite HTML,
+redirect locations, or cookie paths. Use `strip_prefix = false` for an app that
+already serves its prefix. WebSocket upgrades are not supported by these HTTP mounts.
+
+Restart `share run` after editing mounts. The router works with proxy and facade
+MCP modes and any tunnel that forwards the gateway origin. For generated ngrok
+setup, register routes at share creation so the Cloud Endpoint policy permits
+them:
+
+```bash
+snulbug mcp share create \
+  --directory .snulbug/shares/shared-demo \
+  --provider ngrok \
+  --url https://YOUR-NGROK-CLOUD-ENDPOINT/mcp \
+  --upstream http://127.0.0.1:9000 \
+  --http-route /app=http://127.0.0.1:3000 \
+  --http-route /api=http://127.0.0.1:4000
+snulbug mcp share run .snulbug/shares/shared-demo
+```
+
+`--http-route` is repeatable and also available on `share quickstart`. CLI-created
+routes strip their prefix; change that field in TOML when needed. The generated
+ngrok Traffic Policy permits only the MCP endpoint and registered HTTP prefixes,
+and applies its bearer/method/JSON guards only to MCP. Attach the policy to the
+public Cloud Endpoint as described in the [ngrok walkthrough](ngrok-end-to-end.md).
+If prefixes change later, update and reattach the Cloud Endpoint policy as well
+as restarting the gateway; editing TOML alone does not update ngrok's cloud policy.
+
 ## Streamable HTTP edge hardening
 
 `snulbug` enforces MCP Streamable HTTP safety checks at the gateway boundary
@@ -858,6 +920,10 @@ snulbug mcp evidence impact traces/session.jsonl --lease leases.json --report-ou
 In facade mode, leases use the client-facing tool name, such as
 `files.read_file` or `git.status`.
 
+For unattended consumers, [renewable automation invites](mcp-share.md#renewable-automation-invites)
+extend the same task lease with bounded consumer renewal and restart recovery.
+They retain the existing Lua, OAuth identity, revocation, and call-budget checks.
+
 ## Tool Schema Firewall
 
 When `schema_validation = true`, snulbug learns each MCP tool's `inputSchema`

{snulbug-0.2.0 → snulbug-0.2.2}/docs/mcp-share.md

@@ -123,6 +123,94 @@ traffic is observed. The table records evidence source, confidence, risk level,
 categories, and signals such as command-capable arguments, network/path
 arguments, destructive annotations, and open argument schemas.
 
+## Renewable Automation Invites
+
+For an always-on bot, enable **Renewable automation invite** in the console's
+Invites tab, or extend the normal invite command:
+
+```bash
+snulbug mcp share invite create .snulbug/shares/my-share \
+  --recipient nightly-bot --task "Inspect project" \
+  --capability project_readonly \
+  --renewable --ttl 30m --renewal-ttl 7d
+```
+
+`--ttl` controls the short-lived access lease. `--renewal-ttl` is the owner's
+hard authorization deadline, measured from invite creation, not each renewal.
+The backing lease keeps its ID, capabilities, identity bindings, usage count,
+and total `--max-calls` budget. Renewal does not approve policy changes or
+replenish an exhausted budget. Use the existing Lua rate limits for recurring
+request limits; this is not a new daily quota system.
+
+The setup packet includes a renewal credential, a curl command, and a Python
+integration example. Store the renewal credential as a bot secret, separately
+from the short-lived `x-snulbug-lease` token. It is reusable until its deadline
+or revocation, is not an OAuth refresh token, and cannot administer the console
+or create other invites. It is shown only through the existing owner CLI or
+secret-gated console. Protect the share directory and its `invite-secrets.json`.
+
+Consumers use ordinary HTTPS against the **same MCP URL**, so ngrok and other
+generated tunnel routes need no additional public endpoint:
+
+```bash
+export SNULBUG_MCP_URL="https://your-tunnel.example/mcp"
+export SNULBUG_INVITE_ID="invite_..."
+export SNULBUG_RENEWAL_TOKEN="sbr_..."
+# Set SNULBUG_BEARER_TOKEN to the bearer token from the invite packet.
+curl --fail-with-body -sS "$SNULBUG_MCP_URL" \
+  -H "Authorization: Bearer ${SNULBUG_BEARER_TOKEN}" \
+  -H "x-snulbug-renewal: ${SNULBUG_RENEWAL_TOKEN}" \
+  -H 'Content-Type: application/json' \
+  -H 'Accept: application/json, text/event-stream' \
+  -d "{\"jsonrpc\":\"2.0\",\"id\":\"renew\",\"method\":\"snulbug/lease/renew\",\"params\":{\"invite_id\":\"${SNULBUG_INVITE_ID}\"}}"
+```
+
+`snulbug/lease/renew` is a snulbug JSON-RPC extension, not a standard MCP method
+or an upstream tool. Its only parameter is `invite_id`; the consumer cannot
+choose a longer TTL, larger budget, or different capabilities. The gateway
+terminates the request without forwarding the renewal credential upstream.
+Errors use `error.data.reason_code`, even when the HTTP status is 200.
+
+On success, `result.headers` contains the current lease header;
+`result.lease.expires_at` and `result.lease.renewal.renew_after` tell the bot
+when to refresh its MCP client's headers. Call again at `renew_after`, with
+jitter and backoff for network failures. Retries inside the same lease window
+return the same access token. A renewal rotates it with at most 30 seconds of
+overlap for in-flight requests, bounded by the old token's original expiry.
+After a process restart or an expired access lease, the **same operation**
+recovers access while the owner authorization remains valid. No old lease token
+or installed snulbug client is required. Fixed-header clients need a refresh
+integration; a static client configuration does not renew itself.
+
+OAuth shares still require a valid access token obtained from the configured
+identity provider. Bind automation invites using `--allow-issuer` plus
+`--allow-subject` or `--allow-client-id`; optionally add `--allow-tenant`.
+Use that access token as the renewal request's `Authorization` header and the
+separate invite renewal credential as `x-snulbug-renewal`. Required OAuth scopes,
+DPoP requirements, and identity bindings still apply. Tool scope maps, claim
+policies, and Lua continue to govern every ordinary MCP tool call.
+For DPoP-required shares, the consumer must also sign and attach a fresh proof
+for each renewal request using its existing OAuth/DPoP client integration; the
+plain curl/Python examples do not mint proofs or OAuth access tokens.
+
+Revoking the invite or backing lease disables renewal and restart recovery.
+Closing the share with its default revocation option revokes its invites too.
+Even `invite revoke --keep-lease` revokes renewal authority; it leaves only the
+already-issued access lease usable until expiry. Removed capability labels,
+exhausted budgets, and expired renewal authorizations fail closed. Create a new
+invite for a new approval; operator reactivation cannot reset a renewable lease.
+Cleanup retains expired access leases while their renewal authorization is
+active. The console shows authorization expiry, access expiry, next renewal,
+and last renewal/count, and keeps setup snippets synchronized with token rotation.
+Renewal decisions go to the existing audit/event sinks, not the Lua replay log:
+renewing a credential is a control operation, not a simulated policy decision.
+
+Renewal and lease consumption use the existing JSON lease store with file locks
+and atomic replacement, including across local worker processes. Persist that
+file and the share directory across gateway restarts. This does not introduce
+a distributed lease database; separate hosts need a shared authority rather
+than independent copies of `leases.json`.
+
 ## Generated files
 
 By default, the command writes under `.snulbug/shares/share-*` and creates:
@@ -563,6 +651,12 @@ Point clients at `mcp-client.facade.json` for this facade recipe.
 
 ## Public tunnel providers
 
+Shares can also mount HTTP applications on the same tunnel. Add repeatable
+`--http-route /app=http://127.0.0.1:3000` flags to `share create`; MCP stays at
+`/mcp`, while the app route bypasses MCP auth/policy and uses the backend's own
+authentication. Generated ngrok policies permit these prefixes and scope MCP
+checks to `/mcp`. See [shared HTTP routes](mcp-proxy.md#shared-http-routes).
+
 The share command also works with existing tunnel providers:
 
 ```bash

{snulbug-0.2.0 → snulbug-0.2.2}/docs/ngrok-end-to-end.md

@@ -72,6 +72,32 @@ The share writes the important files here:
 `mcp-client.json` contains the bearer token and lease token for the generated
 session. Treat it as secret-bearing material.
 
+### Optional: Share a Webapp on the Same Tunnel
+
+To expose an app on port 3000, add this flag to the `share create` command in
+step 2 before creating the share:
+
+```bash
+--http-route /app=http://127.0.0.1:3000
+```
+
+The generated gateway config and ngrok Traffic Policy now allow `/app` and
+`/app/...` alongside `/mcp`. After starting the app, gateway, and ngrok and
+attaching the generated policy, test both hops without MCP credentials:
+
+```bash
+curl -i http://127.0.0.1:8080/app/
+curl -i "${NGROK_PUBLIC_ORIGIN}/app/"
+```
+
+The route strips `/app` before forwarding, so the app receives `/`. Configure
+its public base path as `/app/` for asset links and redirects. App traffic
+bypasses all MCP authentication/policy/recording; the app owns its authentication.
+See [shared HTTP routes](mcp-proxy.md#shared-http-routes) for multiple backends
+and preserving prefixes. Existing shares need both a TOML route and an updated
+Cloud Endpoint Traffic Policy; changing TOML alone leaves ngrok's old deny rule
+in effect.
+
 ## 3. Export the generated client headers
 
 The generated share requires both bearer auth and an `x-snulbug-lease` header

{snulbug-0.2.0 → snulbug-0.2.2}/docs/release.md

@@ -3,7 +3,8 @@
 1. Finalize `CHANGELOG.md`, with a dated release section and upgrade notes. Keep
    protocol preview limitations distinct from package release readiness.
 2. Bump `version` in `pyproject.toml` and `snulbug/__init__.py`, update the
-   devcontainer feature manifest and its docs/example references, and run `uv lock`.
+   devcontainer feature manifest and its docs/example references (including
+   `examples/codespace_local_gateway/.devcontainer/devcontainer.json`), and run `uv lock`.
 3. Run verification:
 
 ```bash
@@ -24,7 +25,7 @@ The release QA suite runs:
 - isolated built-wheel CLI/module smoke tests outside the source checkout
 - installed-wheel protocol discovery and offline JSON Schema 2020-12 checks
 
-These checks do not certify client/provider E2E interoperability. For 0.2.0,
+These checks do not certify client/provider E2E interoperability. For 0.2.x,
 2025-11-25 remains the default and 2026-07-28 remains an opt-in preview.
 
 Before publishing, include all new modules, docs, tests, and fixtures in the
@@ -48,7 +49,7 @@ python -m zipfile -l dist/snulbug-*.whl
 8. Install from TestPyPI in a clean environment and smoke test:
 
 ```bash
-uvx --index-url https://test.pypi.org/simple/ --extra-index-url https://pypi.org/simple/ snulbug==0.2.0 --help
+uvx --index-url https://test.pypi.org/simple/ --extra-index-url https://pypi.org/simple/ snulbug==0.2.2 --help
 ```
 
 9. Run the manual `Publish` workflow with `repository = pypi` when the TestPyPI
@@ -56,4 +57,4 @@ uvx --index-url https://test.pypi.org/simple/ --extra-index-url https://pypi.org
 10. Create the GitHub release and tag after the PyPI package is available.
 
 The `Publish` workflow uses `workflow_dispatch`, not a tag trigger. Creating or
-pushing `v0.2.0` does not publish a package or automatically create a GitHub release.
+pushing `v0.2.2` does not publish a package or automatically create a GitHub release.

{snulbug-0.2.0 → snulbug-0.2.2}/examples/codespace_local_gateway/.devcontainer/devcontainer.json

@@ -2,7 +2,7 @@
   "name": "snulbug Codespace MCP member",
   "features": {
     "ghcr.io/devcontainers/features/python:1": {},
-    "ghcr.io/nahuaque/snulbug/features/snulbug:0.2.0": {
+    "ghcr.io/nahuaque/snulbug/features/snulbug:0.2.2": {
       "install_source": "github",
       "github_ref": "main",
       "mode": "member-agent",

{snulbug-0.2.0 → snulbug-0.2.2}/features/snulbug/README.md

@@ -6,7 +6,7 @@ workspace helpers for Codespaces/devcontainers.
 ```json
 {
   "features": {
-    "ghcr.io/nahuaque/snulbug/features/snulbug:0.2.0": {
+    "ghcr.io/nahuaque/snulbug/features/snulbug:0.2.2": {
       "install_source": "github",
       "github_ref": "main",
       "mode": "member-agent",

{snulbug-0.2.0 → snulbug-0.2.2}/features/snulbug/devcontainer-feature.json

@@ -1,6 +1,6 @@
 {
   "id": "snulbug",
-  "version": "0.2.0",
+  "version": "0.2.2",
   "name": "snulbug",
   "description": "Install snulbug and optional helpers for MCP policy gateways and remote fabric members in devcontainers.",
   "documentationURL": "https://github.com/nahuaque/snulbug/blob/main/docs/devcontainers.md",

{snulbug-0.2.0 → snulbug-0.2.2}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "snulbug"
-version = "0.2.0"
+version = "0.2.2"
 description = "A local-dev MCP policy proxy with Lua policies, replay logs, and learned least-privilege bundles"
 readme = "README.md"
 requires-python = ">=3.10"
@@ -38,7 +38,7 @@ dependencies = [
     "httpx>=0.28,<1",
     "jsonschema>=4.23,<5",
     "lupa>=2.5",
-    "pyjwt[crypto]>=2.8",
+    "pyjwt[crypto]>=2.15",
     "referencing>=0.35,<1",
     "rich>=15.0.0",
     "tomli>=2.0; python_version < '3.11'",

{snulbug-0.2.0 → snulbug-0.2.2}/snulbug/__init__.py

@@ -1,6 +1,6 @@
 """Local-dev MCP policy proxy and programmable Lua ASGI policy layer."""
 
-__version__ = "0.2.0"
+__version__ = "0.2.2"
 
 from .auth_providers import (
     AuthProvider,
@@ -206,6 +206,7 @@ from .leases import (
     create_lease,
     list_leases,
     reactivate_lease,
+    renew_lease,
     revoke_lease,
 )
 from .manifests import load_manifest, manifest_digest, sign_upstream_manifest, verify_upstream_manifest, write_manifest
@@ -746,6 +747,7 @@ __all__ = [
     "record_audit_event",
     "record_policy_request",
     "reactivate_lease",
+    "renew_lease",
     "reconcile_fabric_controller",
     "reconcile_policy_activation",
     "register_fabric_member",

{snulbug-0.2.0 → snulbug-0.2.2}/snulbug/cli/share.py

@@ -20,6 +20,7 @@ from ..cli_helpers import (
     write_result_output,
     write_sarif_output,
 )
+from ..http_routes import parse_http_route
 from .common import read_required_env
 
 PROVIDERS = ("generic", "ngrok", "cloudflare", "tailscale", "pinggy", "ssh", "holepunch")
@@ -445,6 +446,7 @@ def handle_mcp_share_command(args: argparse.Namespace, parser: argparse.Argument
                 config_output=args.config_output,
                 traces_dir=args.traces_dir,
                 upstream=args.upstream,
+                http_routes=args.http_route,
                 token=args.token,
                 token_env=args.token_env,
                 allowed_tools=args.allow_tool or None,
@@ -506,6 +508,7 @@ def handle_mcp_share_command(args: argparse.Namespace, parser: argparse.Argument
                 provider=args.provider,
                 preset=args.preset,
                 upstream=args.upstream,
+                http_routes=args.http_route,
                 hostname=args.hostname,
                 public_url=args.url,
                 ngrok_internal_url=args.ngrok_internal_url,
@@ -624,6 +627,12 @@ def handle_mcp_share_command(args: argparse.Namespace, parser: argparse.Argument
                     ttl=args.ttl,
                     max_calls=args.max_calls,
                     client_name=args.client_name,
+                    renewable=args.renewable,
+                    renewal_ttl=args.renewal_ttl,
+                    allow_subjects=args.allow_subject,
+                    allow_issuers=args.allow_issuer,
+                    allow_tenants=args.allow_tenant,
+                    allow_client_ids=args.allow_client_id,
                 )
             elif args.share_invite_command == "list":
                 result = list_mcp_share_invites(args.directory, include_revoked=not args.active_only)
@@ -940,6 +949,7 @@ def _add_quickstart_args(parser: argparse.ArgumentParser) -> None:
     parser.add_argument("--config-output", type=Path, default=Path("snulbug.toml"), help="config file path")
     parser.add_argument("--traces-dir", type=Path, default=Path("traces"), help="trace directory path")
     parser.add_argument("--upstream", default="http://127.0.0.1:9000", help="upstream MCP HTTP server URL")
+    _add_http_route_arg(parser)
     add_token_arg(parser, help="bearer token to render into generated policy")
     add_token_env_arg(parser, help="context key used by generated policy for env-derived token lookup")
     parser.add_argument("--allow-tool", action="append", default=[], help="allowed MCP tool name")
@@ -1169,6 +1179,17 @@ def _add_cloudflare_access_setup_args(parser: argparse.ArgumentParser) -> None:
     )
 
 
+def _add_http_route_arg(parser: argparse.ArgumentParser) -> None:
+    parser.add_argument(
+        "--http-route",
+        action="append",
+        type=parse_http_route,
+        default=[],
+        metavar="PREFIX=URL",
+        help="HTTP backend outside MCP auth/policy, e.g. /app=http://127.0.0.1:3000; strips prefix; repeatable",
+    )
+
+
 def _add_share_create_args(parser: argparse.ArgumentParser) -> None:
     parser.add_argument("--directory", type=Path, help="share session directory")
     parser.add_argument(
@@ -1179,6 +1200,7 @@ def _add_share_create_args(parser: argparse.ArgumentParser) -> None:
     )
     parser.add_argument("--preset", default="tunnel-safe", help="MCP policy preset")
     parser.add_argument("--upstream", default="http://127.0.0.1:9000", help="upstream MCP HTTP server")
+    _add_http_route_arg(parser)
     parser.add_argument(
         "--hostname",
         help="provider hostname to use when --url is omitted; for --provider ssh this is the SSH target user@host",
@@ -1472,6 +1494,22 @@ def _add_share_invite_args(parser: argparse.ArgumentParser) -> None:
     invite_create.add_argument("--ttl", default="30m", help="invite lease TTL, such as 30m, 2h, or 1d")
     invite_create.add_argument("--max-calls", type=int, help="maximum number of allowed tools/call uses")
     invite_create.add_argument("--client-name", help="MCP client config server name")
+    invite_create.add_argument(
+        "--renewable", action="store_true", help="allow this automation to renew/recover its short-lived lease"
+    )
+    invite_create.add_argument(
+        "--renewal-ttl", default="7d", help="hard renewal authorization lifetime; defaults to 7d"
+    )
+    invite_create.add_argument(
+        "--allow-subject", action="append", default=[], help="bind the invite to this authenticated subject"
+    )
+    invite_create.add_argument(
+        "--allow-issuer", action="append", default=[], help="bind the invite to this OAuth issuer"
+    )
+    invite_create.add_argument("--allow-tenant", action="append", default=[], help="bind the invite to this tenant")
+    invite_create.add_argument(
+        "--allow-client-id", action="append", default=[], help="bind the invite to this OAuth workload client"
+    )
     add_compact_arg(invite_create)
 
     invite_list = invite_subparsers.add_parser("list", help="list MCP share invites without revealing tokens")

{snulbug-0.2.0 → snulbug-0.2.2}/snulbug/config.py

@@ -8,6 +8,7 @@ from .credentials import attach_upstream_credentials, normalize_fabric_credentia
 from .discovery import apply_fabric_discovery
 from .events import normalize_event_sink_configs
 from .gateway_templates import render_toml_array_table
+from .http_routes import normalize_http_routes
 from .mcp_protocol import DEFAULT_MCP_PROTOCOL_VERSION
 from .policy_backoff import (
     DEFAULT_POLICY_BACKOFF_EXCLUDE_REASON_CODES,
@@ -81,6 +82,7 @@ DEFAULT_MCP_PROXY_CONFIG = {
     "upstream": "http://127.0.0.1:9000",
     "upstream_credential": None,
     "upstreams": [],
+    "http_routes": [],
     "policy": "policy.snulbug/policy.lua",
     "host": "127.0.0.1",
     "port": 8080,
@@ -671,6 +673,9 @@ def normalize_mcp_proxy_config(config: Mapping[str, Any], *, base_dir: str | Pat
         raise ValueError("mcp.proxy.resource_subscription_policy_action must be 'allow', 'warn', or 'block'")
     if not normalized["streamable_http_endpoint_path"].startswith("/"):
         normalized["streamable_http_endpoint_path"] = f"/{normalized['streamable_http_endpoint_path']}"
+    normalized["http_routes"] = normalize_http_routes(
+        normalized.get("http_routes", []), mcp_path=normalized["streamable_http_endpoint_path"]
+    )
     normalized["streamable_http_allowed_origins"] = _normalize_string_list(
         normalized.get("streamable_http_allowed_origins", []),
         field="streamable_http_allowed_origins",

{snulbug-0.2.0 → snulbug-0.2.2}/snulbug/gateway_templates.py

@@ -13,6 +13,7 @@ class GatewayTemplate:
 
     proxy: Mapping[str, Any] = field(default_factory=dict)
     upstreams: Sequence[Mapping[str, Any]] = ()
+    http_routes: Sequence[Mapping[str, Any]] = ()
     auth: Mapping[str, Any] | None = None
     event_sinks: Sequence[Mapping[str, Any]] = ()
     fabric: Mapping[str, Any] | None = None
@@ -39,6 +40,8 @@ def render_gateway_toml(template: GatewayTemplate, *, header: str | None = None)
         _append_block(lines, render_toml_table("mcp.proxy", template.proxy))
     for upstream in template.upstreams:
         _append_block(lines, render_toml_array_table("mcp.proxy.upstreams", upstream))
+    for route in template.http_routes:
+        _append_block(lines, render_toml_array_table("mcp.proxy.http_routes", route))
     if template.auth is not None:
         _append_block(lines, render_toml_table("mcp.auth", template.auth))
     for sink in template.event_sinks: