lael-labs/executor

.env.example+0−2

@@ -25,8 +25,6 @@ CONVEX_SITE_URL=https://your-deployment.convex.site · 24 unmodified lines
25	# EXECUTOR_BACKEND_PORT=5410	25	# EXECUTOR_BACKEND_PORT=5410
26	# EXECUTOR_BACKEND_SITE_PORT=5411	26	# EXECUTOR_BACKEND_SITE_PORT=5411
27	# EXECUTOR_WEB_PORT=5312	27	# EXECUTOR_WEB_PORT=5312
28	# EXECUTOR_MCP_GATEWAY_PORT=5313
29	# NEXT_PUBLIC_LOCAL_MCP_ORIGIN=http://localhost:4313
30		28
31	# ── Discord bot (optional — omit to skip bot startup) ──	29	# ── Discord bot (optional — omit to skip bot startup) ──
32	# DISCORD_BOT_TOKEN=...	30	# DISCORD_BOT_TOKEN=...

README.md+1−1

@@ -63,7 +63,7 @@ bun run dev · 62 unmodified lines
63		63
64	- Convex dev watcher for `executor/`	64	- Convex dev watcher for `executor/`
65	- Executor web app (`http://localhost:4312`)	65	- Executor web app (`http://localhost:4312`)
66	- Executor MCP gateway (`http://localhost:4313/mcp`)	66	- Executor MCP endpoint (`<CONVEX_SITE_URL>/mcp`)
67	- Assistant server (`http://localhost:3000`)	67	- Assistant server (`http://localhost:3000`)
68	- Discord bot (only if `DISCORD_BOT_TOKEN` is set)	68	- Discord bot (only if `DISCORD_BOT_TOKEN` is set)
69		69

dev.ts+3−16

  * Starts:
  *   1. Convex cloud dev function watcher  ─┐
  *   2. Executor web UI (port 4312)        ├─ all started concurrently
- *   3. Executor MCP gateway (port 4313)   │
+ *   3. Assistant server (port 3000)       │
- *   4. Assistant server (port 3000)       │
+ *   4. Discord bot                        ─┘
- *   5. Discord bot                        ─┘
  *
  * All processes are killed when this script exits (Ctrl+C).
  * PIDs are written to .dev.pids for use with `bun run kill:all`.
 const colors = {
   convex: "\x1b[36m",   // cyan
   web: "\x1b[34m",      // blue
-  mcp: "\x1b[33m",      // yellow
   assistant: "\x1b[32m", // green
   bot: "\x1b[35m",      // magenta
   reset: "\x1b[0m",
 // ── Kill stale processes from a previous run ──
 const EXECUTOR_WEB_PORT = Number(Bun.env.EXECUTOR_WEB_PORT ?? 4312);
-const EXECUTOR_MCP_PORT = Number(Bun.env.EXECUTOR_MCP_GATEWAY_PORT ?? 4313);
+const DEV_PORTS = [3000, EXECUTOR_WEB_PORT];
-const DEV_PORTS = [3000, EXECUTOR_WEB_PORT, EXECUTOR_MCP_PORT];
 async function killStaleProcesses() {
   let killed = 0;
   cwd: "./executor/apps/web",
 });
-spawnService("mcp", ["bun", "run", "dev:mcp-gateway"], {
-  cwd: "./executor",
-  env: {
-    EXECUTOR_MCP_GATEWAY_PORT: String(EXECUTOR_MCP_PORT),
-    MCP_GATEWAY_REQUIRE_AUTH: "0",
-    MCP_AUTHORIZATION_SERVER: "",
-    MCP_AUTHORIZATION_SERVER_URL: "",
-  },
-});
 spawnService("assistant", ["bun", "run", "dev"], {
   cwd: "./assistant/packages/server",
   env: {

executor/README.md+7−30

 - task execution (`run_code`) with tool invocation and approval gates
 - workspace-scoped policy, credentials, and tool source management
-- MCP endpoints (Convex HTTP routes and a standalone Bun gateway)
+- MCP endpoints (Convex HTTP routes)
 - a Next.js web app for tasks, approvals, tools, members, and billing
 - a binary-first install flow for local self-hosted runtime
 - `convex/http.ts`: HTTP routes for `/mcp`, OAuth discovery metadata, and internal runtime callbacks.
 - `convex/executorNode.ts`: task runner action (`runTask`) and tool invocation plumbing.
 - `lib/`: runtime engine, typechecker, tool discovery, external source adapters (MCP/OpenAPI/GraphQL), credential provider resolvers.
-- `mcp-gateway.ts`: standalone stateful MCP gateway with anonymous OAuth and optional WorkOS token verification.
 - `apps/web/`: operator UI (dashboard, tasks, approvals, tools, onboarding, org settings).
 - `executor.ts`: CLI entrypoint used by local source scripts and compiled binary releases.
 # Terminal 2: Web UI
 bun run dev:executor:web
-# Terminal 3 (optional but recommended for stateful MCP transport)
-bun run --cwd executor dev:mcp-gateway
 ```
 Default source-dev endpoints:
 - Web UI: `http://localhost:4312`
-- MCP gateway: `http://localhost:4313/mcp`
-- Gateway health: `http://localhost:4313/health`
 - Convex HTTP MCP route: `<CONVEX_SITE_URL>/mcp`
 ## Binary Install (No Global Bun/Node/Convex Required)
 executor up
 executor backend --help
 executor web
-executor gateway
 ```
 Uninstall:
 - backend API: `5410`
 - backend site proxy: `5411`
 - packaged web app: `5312`
-- MCP gateway: `5313`
 ## CLI Commands (executor/package.json)
 bun run up
 bun run backend -- --help
 bun run web
-bun run gateway
 bun run codegen
 bun run deploy
 bun run build:binary
 ## MCP and OAuth Surface
-Gateway routes (`mcp-gateway.ts`):
+Convex HTTP routes (`convex/http.ts`) expose:
-- `/mcp` (GET/POST/DELETE)
+- `/mcp` (direct Convex MCP transport)
 - `/.well-known/oauth-protected-resource`
 - `/.well-known/oauth-authorization-server`
-- `/oauth2/jwks`
-- `/register`
-- `/authorize`
-- `/token`
-- `/health`
-Convex HTTP routes (`convex/http.ts`) also expose:
-- `/mcp` (direct Convex MCP transport)
 - `/internal/runs/:runId/tool-call`
 - `/internal/runs/:runId/output`
-Anonymous OAuth is always available on the standalone gateway. WorkOS token verification is enabled when `MCP_AUTHORIZATION_SERVER` (or `MCP_AUTHORIZATION_SERVER_URL`) is configured.
+MCP bearer-token verification is enabled when `MCP_AUTHORIZATION_SERVER` (or `MCP_AUTHORIZATION_SERVER_URL`) is configured.
 ## Configuration Reference
   - `STRIPE_PRICE_ID`
 - MCP auth integration:
   - `MCP_AUTHORIZATION_SERVER` or `MCP_AUTHORIZATION_SERVER_URL`
-- Managed runtime and gateway:
+- Managed runtime:
   - `EXECUTOR_RUNTIME_DIR`
   - `EXECUTOR_BACKEND_PORT`
   - `EXECUTOR_BACKEND_SITE_PORT`
   - `EXECUTOR_WEB_PORT`
-  - `EXECUTOR_MCP_GATEWAY_PORT`
-  - `EXECUTOR_INTERNAL_TOKEN` (recommended for Convex-backed anonymous OAuth key/client persistence)
-  - `NEXT_PUBLIC_LOCAL_MCP_ORIGIN`
 ## Credential Providers
 executor/
 |- apps/web/                 # Next.js operator UI
 |- convex/                   # Convex functions, schema, auth, HTTP routes
-|- lib/                      # runtime, tool loading/discovery, gateway helpers
+|- lib/                      # runtime, tool loading/discovery, helper modules
 |- scripts/build-release.ts  # release artifact builder
 |- executor.ts               # CLI entrypoint (compiled into binary)
-|- mcp-gateway.ts            # standalone MCP + OAuth gateway
 |- install                   # curl install script
 `- uninstall                 # uninstall script
 ```
 ## Troubleshooting
-- `401` on `/mcp`: the gateway expects OAuth bearer tokens; complete MCP OAuth client flow first.
+- `401` on `/mcp`: verify your bearer token issuer matches `MCP_AUTHORIZATION_SERVER` (or disable MCP OAuth in local dev).
 - Web UI cannot load data: verify `CONVEX_URL` / `CONVEX_SITE_URL` and that Convex dev is running.
-- Gateway OAuth state resets between restarts: set `EXECUTOR_INTERNAL_TOKEN` so gateway can persist keys/clients in Convex.
 - Release build missing web archive for your platform: run `bun run build:release` on that target platform.

executor/apps/web/next.config.ts+14−0

@@ -1,5 +1,15 @@
1	import type { NextConfig } from "next";	1	import type { NextConfig } from "next";
2		2
		3	function toSiteUrl(convexUrl?: string): string \| undefined {
		4	if (!convexUrl) {
		5	return undefined;
		6	}
		7	if (convexUrl.includes(".convex.cloud")) {
		8	return convexUrl.replace(".convex.cloud", ".convex.site");
		9	}
		10	return convexUrl;
		11	}
		12
3	const appShellRewriteExclusions = [	13	const appShellRewriteExclusions = [
4	"api(?:/\|$)",	14	"api(?:/\|$)",
5	"_next(?:/\|$)",	15	"_next(?:/\|$)",
@@ -21,6 +31,10 @@ const nextConfig: NextConfig = { · 15 unmodified lines
21	// Map canonical env vars to NEXT_PUBLIC_ so they're available client-side.	31	// Map canonical env vars to NEXT_PUBLIC_ so they're available client-side.
22	// This lets us keep a single root .env without NEXT_PUBLIC_ prefixes.	32	// This lets us keep a single root .env without NEXT_PUBLIC_ prefixes.
23	NEXT_PUBLIC_CONVEX_URL: process.env.EXECUTOR_WEB_CONVEX_URL ?? process.env.CONVEX_URL,	33	NEXT_PUBLIC_CONVEX_URL: process.env.EXECUTOR_WEB_CONVEX_URL ?? process.env.CONVEX_URL,
		34	NEXT_PUBLIC_CONVEX_SITE_URL:
		35	process.env.EXECUTOR_WEB_CONVEX_SITE_URL
		36	?? process.env.CONVEX_SITE_URL
		37	?? toSiteUrl(process.env.EXECUTOR_WEB_CONVEX_URL ?? process.env.CONVEX_URL),
24	NEXT_PUBLIC_WORKOS_CLIENT_ID: process.env.WORKOS_CLIENT_ID,	38	NEXT_PUBLIC_WORKOS_CLIENT_ID: process.env.WORKOS_CLIENT_ID,
25	NEXT_PUBLIC_STRIPE_PRICE_ID: process.env.STRIPE_PRICE_ID,	39	NEXT_PUBLIC_STRIPE_PRICE_ID: process.env.STRIPE_PRICE_ID,
26	},	40	},

executor/apps/web/src/components/mcp-setup-card.tsx+1−32

@@ -41,10 +41,6 @@ function resolveMcpOrigin(windowOrigin: string): string { · 40 unmodified lines
41	return windowOrigin;	41	return windowOrigin;
42	}	42	}
43		43
44	function isLocalHostname(hostname: string): boolean {
45	return hostname === "localhost" \|\| hostname === "127.0.0.1" \|\| hostname === "0.0.0.0";
46	}
47
48	export function McpSetupCard({	44	export function McpSetupCard({
49	workspaceId,	45	workspaceId,
50	actorId,	46	actorId,
@@ -56,26 +52,12 @@ export function McpSetupCard({ · 5 unmodified lines
56	}) {	52	}) {
57	const [selectedProviderId, setSelectedProviderId] = useState(MCP_PROVIDERS[0]?.id ?? "claude-code");	53	const [selectedProviderId, setSelectedProviderId] = useState(MCP_PROVIDERS[0]?.id ?? "claude-code");
58	const [copiedKey, setCopiedKey] = useState<string \| null>(null);	54	const [copiedKey, setCopiedKey] = useState<string \| null>(null);
59	const [urlMode, setUrlMode] = useState<"default" \| "local">(() => {
60	if (typeof window === "undefined") {
61	return "default";
62	}
63	return isLocalHostname(window.location.hostname) ? "local" : "default";
64	});
65		55
66	const defaultOrigin = useMemo(() => {	56	const origin = useMemo(() => {
67	if (typeof window === "undefined") return "";	57	if (typeof window === "undefined") return "";
68	return resolveMcpOrigin(window.location.origin);	58	return resolveMcpOrigin(window.location.origin);
69	}, []);	59	}, []);
70		60
71	const showLocalGatewayOption = useMemo(() => {
72	if (typeof window === "undefined") return false;
73	return isLocalHostname(window.location.hostname);
74	}, []);
75
76	const localGatewayOrigin = (process.env.NEXT_PUBLIC_LOCAL_MCP_ORIGIN ?? "http://localhost:4313").trim().replace(/\/$/, "");
77	const origin = urlMode === "local" ? localGatewayOrigin : defaultOrigin;
78
79	const mcpUrl = useMemo(() => {	61	const mcpUrl = useMemo(() => {
80	const base = origin ? new URL("/mcp", origin) : new URL("http://localhost/mcp");	62	const base = origin ? new URL("/mcp", origin) : new URL("http://localhost/mcp");
81	if (workspaceId) base.searchParams.set("workspaceId", workspaceId);	63	if (workspaceId) base.searchParams.set("workspaceId", workspaceId);
@@ -112,19 +94,6 @@ export function McpSetupCard({ · 30 unmodified lines
112	<div className="space-y-5">	94	<div className="space-y-5">
113	<div className="space-y-1.5">	95	<div className="space-y-1.5">
114	<Label className="text-xs text-muted-foreground">MCP Server URL</Label>	96	<Label className="text-xs text-muted-foreground">MCP Server URL</Label>
115	{showLocalGatewayOption ? (
116	<div className="space-y-1.5">
117	<Select value={urlMode} onValueChange={(value) => setUrlMode(value as "default" \| "local")}>
118	<SelectTrigger className="h-8 text-xs bg-background">
119	<SelectValue />
120	</SelectTrigger>
121	<SelectContent>
122	<SelectItem value="local" className="text-xs">Local gateway (localhost:4313)</SelectItem>
123	<SelectItem value="default" className="text-xs">Hosted endpoint</SelectItem>
124	</SelectContent>
125	</Select>
126	</div>
127	) : null}
128	<div className="flex items-center gap-2">	97	<div className="flex items-center gap-2">
129	<Input value={mcpUrl} readOnly className="h-8 text-xs font-mono bg-background" />	98	<Input value={mcpUrl} readOnly className="h-8 text-xs font-mono bg-background" />
130	<Button	99	<Button

executor/executor.ts+2−13

 #!/usr/bin/env bun
 import fs from "node:fs/promises";
-import { startMcpGateway } from "./mcp-gateway";
 import { managedRuntimeDiagnostics, runManagedBackend, runManagedWeb } from "./lib/managed_runtime";
 function printHelp(): void {
   executor up [backend-args]
   executor backend <args>
   executor web [--port <number>]
-  executor gateway [--port <number>]
 Commands:
   doctor        Bootstrap and verify managed Convex backend runtime
   up            Run managed backend and auto-bootstrap Convex functions
   backend       Pass through arguments to managed convex-local-backend binary
   web           Run packaged web UI (default port: 5312)
-  gateway       Start Executor MCP gateway (default port: 5313)
 `);
 }
   if (command === "doctor") {
     const info = await managedRuntimeDiagnostics();
     const webPort = Number(Bun.env.EXECUTOR_WEB_PORT ?? 5312);
-    const gatewayPort = Number(Bun.env.EXECUTOR_MCP_GATEWAY_PORT ?? 5313);
     const webInstalled = await pathExists(info.webServerEntry);
     const nodeInstalled = await pathExists(info.nodeBin);
     const backendRunning = await checkHttp(`${info.convexUrl}/version`);
     const webRunning = await checkHttp(`http://127.0.0.1:${webPort}/`);
-    const gatewayRunning = await checkHttp(`http://127.0.0.1:${gatewayPort}/health`);
     console.log("Managed runtime ready");
     console.log(`  root: ${info.rootDir}`);
     console.log(`  node runtime: ${nodeInstalled ? info.nodeBin : "not installed yet (installed by 'executor web')"}`);
     console.log(`  web bundle: ${webInstalled ? info.webServerEntry : "not installed yet (installed by 'executor web')"}`);
     console.log(`  web URL: http://127.0.0.1:${webPort}`);
-    console.log(`  gateway URL: http://127.0.0.1:${gatewayPort}/mcp`);
+    console.log(`  mcp URL: ${info.convexSiteUrl}/mcp`);
-    console.log(`  running: backend=${backendRunning ? "yes" : "no"} web=${webRunning ? "yes" : "no"} gateway=${gatewayRunning ? "yes" : "no"}`);
+    console.log(`  running: backend=${backendRunning ? "yes" : "no"} web=${webRunning ? "yes" : "no"}`);
     console.log(`  config: ${info.configPath}`);
     return;
   }
     process.exit(exitCode);
   }
-  if (command === "gateway") {
-    const port = parsePort(rest);
-    startMcpGateway(port);
-    return;
-  }
   if (command === "web") {
     const port = parsePort(rest);
     const exitCode = await runManagedWeb({ port });

executor/install+0−1

@@ -266,7 +266,6 @@ echo "Run:" · 265 unmodified lines
266	echo " executor doctor"	266	echo " executor doctor"
267	echo " executor up"	267	echo " executor up"
268	echo " executor web # defaults to http://localhost:5312"	268	echo " executor web # defaults to http://localhost:5312"
269	echo " executor gateway # defaults to http://localhost:5313/mcp"
270	echo ""	269	echo ""
271	echo "To uninstall later:"	270	echo "To uninstall later:"
272	echo " bash executor/uninstall --yes"	271	echo " bash executor/uninstall --yes"

executor/lib/managed_runtime.ts+0−2

   await ensureNodeRuntime(info);
   await ensureWebBundle(info);
-  const mcpPort = Number(Bun.env.EXECUTOR_MCP_GATEWAY_PORT ?? 5313);
   const webPort = options.port ?? Number(Bun.env.EXECUTOR_WEB_PORT ?? 5312);
   const host = Bun.env.EXECUTOR_WEB_INTERFACE ?? "127.0.0.1";
     HOSTNAME: host,
     CONVEX_URL: process.env.CONVEX_URL ?? `http://${info.config.hostInterface}:${info.config.backendPort}`,
     CONVEX_SITE_URL: process.env.CONVEX_SITE_URL ?? `http://${info.config.hostInterface}:${info.config.siteProxyPort}`,
-    NEXT_PUBLIC_LOCAL_MCP_ORIGIN: process.env.NEXT_PUBLIC_LOCAL_MCP_ORIGIN ?? `http://localhost:${mcpPort}`,
   };
   const proc = await runProcess(info.nodeBin, [info.webServerEntry], {

executor/mcp-gateway.ts+0−532

@@ -1,532 +0,0 @@
1	import { ConvexHttpClient } from "convex/browser";
2	import { createRemoteJWKSet, jwtVerify } from "jose";
3	import { api } from "./convex/_generated/api";
4	import { handleMcpRequest, type McpWorkspaceContext } from "./lib/mcp_server";
5	import { AnonymousOAuthServer, OAuthBadRequest } from "./lib/anonymous-oauth";
6	import { ConvexOAuthStorage } from "./lib/convex-oauth-storage";
7	import type { AnonymousContext, PendingApprovalRecord, TaskRecord, ToolDescriptor } from "./lib/types";
8	import type { Id } from "./convex/_generated/dataModel";
9
10	// ---------------------------------------------------------------------------
11	// Verified token result — unified across WorkOS and self-issued anonymous JWTs
12	// ---------------------------------------------------------------------------
13
14	interface VerifiedToken {
15	sub: string;
16	provider: "workos" \| "anonymous";
17	/** The raw bearer token string (needed for WorkOS tokens to forward to Convex). */
18	rawToken: string;
19	}
20
21	// ---------------------------------------------------------------------------
22	// Configuration
23	// ---------------------------------------------------------------------------
24
25	let convexUrl: string \| undefined;
26	let workosAuthorizationServer: string \| undefined;
27	let workosJwks: ReturnType<typeof createRemoteJWKSet> \| null = null;
28	let anonOAuth: AnonymousOAuthServer \| null = null;
29
30	function loadConfigFromEnv(): void {
31	const convexUrlFromEnv = Bun.env.CONVEX_URL;
32	if (!convexUrlFromEnv) {
33	throw new Error("CONVEX_URL is required.");
34	}
35
36	convexUrl = convexUrlFromEnv;
37	workosAuthorizationServer =
38	Bun.env.MCP_AUTHORIZATION_SERVER
39	?? Bun.env.MCP_AUTHORIZATION_SERVER_URL
40	?? Bun.env.WORKOS_AUTHKIT_ISSUER
41	?? Bun.env.WORKOS_AUTHKIT_DOMAIN;
42	workosJwks = workosAuthorizationServer
43	? createRemoteJWKSet(new URL("/oauth2/jwks", workosAuthorizationServer))
44	: null;
45	}
46
47	async function initAnonymousOAuth(issuer: string): Promise<void> {
48	const internalSecret = Bun.env.EXECUTOR_INTERNAL_TOKEN;
49	const storage = convexUrl && internalSecret
50	? new ConvexOAuthStorage(convexUrl, internalSecret)
51	: undefined;
52
53	anonOAuth = new AnonymousOAuthServer({ issuer, storage });
54	await anonOAuth.init();
55	}
56
57	function requireConvexUrl(): string {
58	if (!convexUrl) {
59	throw new Error("CONVEX_URL is required.");
60	}
61	return convexUrl;
62	}
63
64	// ---------------------------------------------------------------------------
65	// Token parsing & verification
66	// ---------------------------------------------------------------------------
67
68	function parseBearerToken(request: Request): string \| null {
69	const header = request.headers.get("authorization");
70	if (!header \|\| !header.startsWith("Bearer ")) {
71	return null;
72	}
73	const token = header.slice("Bearer ".length).trim();
74	return token.length > 0 ? token : null;
75	}
76
77	/**
78	* Unified token verification. Tries the self-issued anonymous OAuth server
79	* first (fast, in-process), then falls back to the external WorkOS JWKS.
80	*/
81	async function verifyToken(request: Request): Promise<VerifiedToken \| null> {
82	const rawToken = parseBearerToken(request);
83	if (!rawToken) {
84	return null;
85	}
86
87	// 1. Try the self-issued anonymous OAuth server
88	if (anonOAuth) {
89	const anon = await anonOAuth.verifyToken(rawToken);
90	if (anon) {
91	return { sub: anon.sub, provider: "anonymous", rawToken };
92	}
93	}
94
95	// 2. Try WorkOS
96	if (workosAuthorizationServer && workosJwks) {
97	try {
98	const { payload } = await jwtVerify(rawToken, workosJwks, {
99	issuer: workosAuthorizationServer,
100	});
101	if (typeof payload.sub === "string" && payload.sub.length > 0) {
102	return { sub: payload.sub, provider: "workos", rawToken };
103	}
104	} catch {
105	// Not a valid WorkOS token either
106	}
107	}
108
109	return null;
110	}
111
112	// ---------------------------------------------------------------------------
113	// OAuth response helpers
114	// ---------------------------------------------------------------------------
115
116	function resourceMetadataUrl(request: Request): string {
117	const url = new URL(request.url);
118	return `${url.origin}/.well-known/oauth-protected-resource`;
119	}
120
121	function unauthorizedMcpResponse(request: Request, message: string): Response {
122	const challenge = [
123	'Bearer error="unauthorized"',
124	'error_description="Authorization needed"',
125	`resource_metadata="${resourceMetadataUrl(request)}"`,
126	].join(", ");
127
128	return Response.json(
129	{ error: message },
130	{
131	status: 401,
132	headers: {
133	"WWW-Authenticate": challenge,
134	},
135	},
136	);
137	}
138
139	// ---------------------------------------------------------------------------
140	// Workspace ID parsing
141	// ---------------------------------------------------------------------------
142
143	/**
144	* Validated boundary for external workspace ID strings.
145	* Convex IDs are opaque strings at runtime; this cast is the single
146	* validated entry point so downstream code never needs ad-hoc casts.
147	*/
148	function parseWorkspaceId(raw: string): Id<"workspaces"> {
149	return raw as Id<"workspaces">;
150	}
151
152	function parseRequestedContext(url: URL): {
153	workspaceId?: Id<"workspaces">;
154	clientId?: string;
155	} {
156	const rawWorkspaceId = url.searchParams.get("workspaceId");
157	const workspaceId = rawWorkspaceId ? parseWorkspaceId(rawWorkspaceId) : undefined;
158	const clientId = url.searchParams.get("clientId") ?? undefined;
159	return { workspaceId, clientId };
160	}
161
162	// ---------------------------------------------------------------------------
163	// Service factory
164	// ---------------------------------------------------------------------------
165
166	function createService(context?: McpWorkspaceContext, bearerToken?: string) {
167	const convex = new ConvexHttpClient(requireConvexUrl());
168	if (bearerToken) {
169	convex.setAuth(bearerToken);
170	}
171
172	const workspaceId = context?.workspaceId;
173	const sessionId = context?.sessionId;
174
175	return {
176	createTask: async (input: {
177	code: string;
178	timeoutMs?: number;
179	runtimeId?: string;
180	metadata?: Record<string, unknown>;
181	workspaceId: Id<"workspaces">;
182	actorId: string;
183	clientId?: string;
184	}) => {
185	const created = await convex.mutation(api.executor.createTask, {
186	workspaceId: input.workspaceId,
187	sessionId,
188	code: input.code,
189	timeoutMs: input.timeoutMs,
190	runtimeId: input.runtimeId,
191	metadata: input.metadata,
192	actorId: input.actorId,
193	clientId: input.clientId,
194	});
195	return created as { task: TaskRecord };
196	},
197
198	getTask: async (taskId: string, workspace?: Id<"workspaces">) => {
199	const effectiveWorkspaceId = workspace ?? workspaceId;
200	if (!effectiveWorkspaceId) {
201	return null;
202	}
203	const task = await convex.query(api.workspace.getTaskInWorkspace, {
204	workspaceId: effectiveWorkspaceId,
205	sessionId,
206	taskId,
207	});
208	return task as TaskRecord \| null;
209	},
210
211	subscribe: () => () => {},
212
213	bootstrapAnonymousContext: async (requestedSessionId?: string) => {
214	const bootstrap = await convex.mutation(api.workspace.bootstrapAnonymousSession, {
215	sessionId: requestedSessionId,
216	});
217	return bootstrap as AnonymousContext;
218	},
219
220	listTools: async (toolContext?: { workspaceId: Id<"workspaces">; actorId?: string; clientId?: string }) => {
221	if (!toolContext) {
222	return [];
223	}
224	const tools = await convex.action(api.executorNode.listTools, {
225	workspaceId: toolContext.workspaceId,
226	sessionId,
227	actorId: toolContext.actorId,
228	clientId: toolContext.clientId,
229	});
230	return tools as ToolDescriptor[];
231	},
232
233	listPendingApprovals: async (approvalWorkspaceId: Id<"workspaces">) => {
234	const approvals = await convex.query(api.workspace.listPendingApprovals, {
235	workspaceId: approvalWorkspaceId,
236	sessionId,
237	});
238	return approvals as PendingApprovalRecord[];
239	},
240
241	resolveApproval: async (input: {
242	workspaceId: Id<"workspaces">;
243	approvalId: string;
244	decision: "approved" \| "denied";
245	reviewerId?: string;
246	reason?: string;
247	}) => {
248	return await convex.mutation(api.executor.resolveApproval, {
249	workspaceId: input.workspaceId,
250	sessionId,
251	approvalId: input.approvalId,
252	decision: input.decision,
253	reviewerId: input.reviewerId,
254	reason: input.reason,
255	});
256	},
257	};
258	}
259
260	// ---------------------------------------------------------------------------
261	// Context resolution
262	// ---------------------------------------------------------------------------
263
264	async function resolveContextForWorkos(
265	workspaceId: Id<"workspaces">,
266	bearerToken: string,
267	clientId?: string,
268	): Promise<McpWorkspaceContext> {
269	const convex = new ConvexHttpClient(requireConvexUrl());
270	convex.setAuth(bearerToken);
271
272	const requestContext = await convex.query(api.workspace.getRequestContext, {
273	workspaceId,
274	});
275
276	return {
277	workspaceId: requestContext.workspaceId,
278	actorId: requestContext.actorId,
279	clientId,
280	};
281	}
282
283	// ---------------------------------------------------------------------------
284	// MCP handler
285	// ---------------------------------------------------------------------------
286
287	async function handleMcp(request: Request): Promise<Response> {
288	const verified = await verifyToken(request);
289
290	// No token at all — return 401 so MCP clients discover the auth server
291	if (!verified) {
292	return unauthorizedMcpResponse(request, "Authorization required.");
293	}
294
295	const url = new URL(request.url);
296	const requested = parseRequestedContext(url);
297
298	let context: McpWorkspaceContext \| undefined;
299
300	if (verified.provider === "workos") {
301	// WorkOS-authenticated user: must provide workspaceId
302	if (!requested.workspaceId) {
303	return Response.json(
304	{ error: "workspaceId query parameter is required for authenticated users" },
305	{ status: 400 },
306	);
307	}
308
309	try {
310	context = await resolveContextForWorkos(
311	requested.workspaceId,
312	verified.rawToken,
313	requested.clientId,
314	);
315	} catch (error) {
316	return Response.json(
317	{ error: error instanceof Error ? error.message : "Workspace authorization failed" },
318	{ status: 403 },
319	);
320	}
321	}
322	// Anonymous tokens: context is resolved lazily via bootstrapAnonymousContext
323	// in the MCP server's run_code handler (using the token sub as the actor).
324	// If workspaceId is provided, it will be passed through but the anonymous
325	// session bootstrap will create one if needed.
326
327	const bearerToken = verified.provider === "workos" ? verified.rawToken : undefined;
328	const service = createService(context, bearerToken);
329	return await handleMcpRequest(service, request, context);
330	}
331
332	// ---------------------------------------------------------------------------
333	// OAuth endpoints — self-issued anonymous auth server
334	// ---------------------------------------------------------------------------
335
336	function handleProtectedResourceMetadata(request: Request): Response {
337	const url = new URL(request.url);
338	const authorizationServers: string[] = [];
339
340	// Always advertise the self-issued anonymous auth server
341	if (anonOAuth) {
342	authorizationServers.push(anonOAuth.getIssuer());
343	}
344
345	// Also advertise WorkOS if configured
346	if (workosAuthorizationServer) {
347	authorizationServers.push(workosAuthorizationServer);
348	}
349
350	if (authorizationServers.length === 0) {
351	return Response.json({ error: "No authorization servers configured" }, { status: 404 });
352	}
353
354	return Response.json({
355	resource: `${url.origin}/mcp`,
356	authorization_servers: authorizationServers,
357	bearer_methods_supported: ["header"],
358	});
359	}
360
361	function handleAuthServerMetadata(): Response {
362	if (!anonOAuth) {
363	return Response.json({ error: "Anonymous OAuth server not initialized" }, { status: 500 });
364	}
365	return Response.json(anonOAuth.getMetadata());
366	}
367
368	function handleJwks(): Response {
369	if (!anonOAuth) {
370	return Response.json({ error: "Anonymous OAuth server not initialized" }, { status: 500 });
371	}
372	return Response.json(anonOAuth.getJwks(), {
373	headers: { "cache-control": "public, max-age=3600" },
374	});
375	}
376
377	async function handleRegister(request: Request): Promise<Response> {
378	if (!anonOAuth) {
379	return Response.json({ error: "Anonymous OAuth server not initialized" }, { status: 500 });
380	}
381
382	let body: unknown;
383	try {
384	body = await request.json();
385	} catch {
386	return Response.json({ error: "Invalid JSON body" }, { status: 400 });
387	}
388
389	try {
390	const registration = await anonOAuth.registerClient(body as any);
391	return Response.json(registration, { status: 201 });
392	} catch (error) {
393	if (error instanceof OAuthBadRequest) {
394	return Response.json(
395	{ error: "invalid_client_metadata", error_description: error.message },
396	{ status: 400 },
397	);
398	}
399	throw error;
400	}
401	}
402
403	async function handleAuthorize(request: Request): Promise<Response> {
404	if (!anonOAuth) {
405	return Response.json({ error: "Anonymous OAuth server not initialized" }, { status: 500 });
406	}
407
408	const url = new URL(request.url);
409	try {
410	const { redirectTo } = await anonOAuth.authorize(url.searchParams);
411	return Response.redirect(redirectTo, 302);
412	} catch (error) {
413	if (error instanceof OAuthBadRequest) {
414	return Response.json(
415	{ error: "invalid_request", error_description: error.message },
416	{ status: 400 },
417	);
418	}
419	throw error;
420	}
421	}
422
423	async function handleToken(request: Request): Promise<Response> {
424	if (!anonOAuth) {
425	return Response.json({ error: "Anonymous OAuth server not initialized" }, { status: 500 });
426	}
427
428	let body: URLSearchParams;
429	try {
430	const text = await request.text();
431	body = new URLSearchParams(text);
432	} catch {
433	return Response.json({ error: "Invalid request body" }, { status: 400 });
434	}
435
436	try {
437	const tokens = await anonOAuth.exchangeToken(body);
438	return Response.json(tokens, {
439	headers: {
440	"cache-control": "no-store",
441	"pragma": "no-cache",
442	},
443	});
444	} catch (error) {
445	if (error instanceof OAuthBadRequest) {
446	return Response.json(
447	{ error: "invalid_grant", error_description: error.message },
448	{ status: 400 },
449	);
450	}
451	throw error;
452	}
453	}
454
455	// ---------------------------------------------------------------------------
456	// Server
457	// ---------------------------------------------------------------------------
458
459	export async function startMcpGateway(
460	port = Number(Bun.env.EXECUTOR_MCP_GATEWAY_PORT ?? Bun.env.PORT ?? 5313),
461	): Promise<ReturnType<typeof Bun.serve>> {
462	loadConfigFromEnv();
463
464	// Initialize the self-issued anonymous OAuth server.
465	// The issuer must match the gateway's public origin.
466	const gatewayOrigin = Bun.env.MCP_GATEWAY_ORIGIN ?? `http://localhost:${port}`;
467	await initAnonymousOAuth(gatewayOrigin);
468
469	// Periodically purge expired authorization codes
470	setInterval(() => {
471	anonOAuth?.purgeExpiredCodes();
472	}, 60_000);
473
474	const server = Bun.serve({
475	port,
476	async fetch(request) {
477	const url = new URL(request.url);
478
479	if (url.pathname === "/health") {
480	return new Response("ok");
481	}
482
483	// ── MCP endpoint ──────────────────────────────────────────────────
484	if (url.pathname === "/" \|\| url.pathname === "/mcp") {
485	if (request.method === "POST" \|\| request.method === "GET" \|\| request.method === "DELETE") {
486	return await handleMcp(request);
487	}
488	return new Response("Method Not Allowed", { status: 405 });
489	}
490
491	// ── OAuth discovery (RFC 9728 + RFC 8414) ─────────────────────────
492	if (url.pathname === "/.well-known/oauth-protected-resource") {
493	return handleProtectedResourceMetadata(request);
494	}
495
496	if (url.pathname === "/.well-known/oauth-authorization-server") {
497	return handleAuthServerMetadata();
498	}
499
500	// ── Self-issued OAuth endpoints ───────────────────────────────────
501	if (url.pathname === "/oauth2/jwks") {
502	return handleJwks();
503	}
504
505	if (url.pathname === "/register" && request.method === "POST") {
506	return await handleRegister(request);
507	}
508
509	if (url.pathname === "/authorize" && request.method === "GET") {
510	return await handleAuthorize(request);
511	}
512
513	if (url.pathname === "/token" && request.method === "POST") {
514	return await handleToken(request);
515	}
516
517	return new Response("Not found", { status: 404 });
518	},
519	});
520
521	const hasWorkos = Boolean(workosAuthorizationServer);
522	console.log(
523	`[executor-mcp-gateway] listening on http://localhost:${port}/mcp`
524	+ ` (anonymous-oauth: enabled, workos: ${hasWorkos ? "enabled" : "disabled"})`,
525	);
526
527	return server;
528	}
529
530	if (import.meta.main) {
531	await startMcpGateway();
532	}

executor/package.json+1−4

     "backend": "bun run executor.ts backend",
     "convex": "bun run executor.ts backend",
     "web": "bun run executor.ts web",
-    "gateway": "bun run executor.ts gateway",
     "deploy": "bunx convex deploy",
     "codegen": "bunx convex codegen",
     "build:binary": "bun build executor.ts --compile --outfile dist/executor",
-    "build:release": "bun run scripts/build-release.ts",
+    "build:release": "bun run scripts/build-release.ts"
-    "dev:mcp-gateway": "EXECUTOR_MCP_GATEWAY_PORT=4313 bun --hot mcp-gateway.ts",
-    "start:mcp-gateway": "bun mcp-gateway.ts"
   },
   "dependencies": {
     "convex": "^1.31.7"

executor/scripts/build-release.ts+1−1

@@ -81,7 +81,7 @@ async function buildWebArtifact(rootDir: string, releaseDir: string, checksums: · 80 unmodified lines
81	const webBuildEnv = {	81	const webBuildEnv = {
82	...process.env,	82	...process.env,
83	EXECUTOR_WEB_CONVEX_URL: "http://127.0.0.1:5410",	83	EXECUTOR_WEB_CONVEX_URL: "http://127.0.0.1:5410",
84	NEXT_PUBLIC_LOCAL_MCP_ORIGIN: "http://localhost:5313",	84	EXECUTOR_WEB_CONVEX_SITE_URL: "http://127.0.0.1:5411",
85	};	85	};
86		86
87	await runCommand(["bunx", "next", "build"], {	87	await runCommand(["bunx", "next", "build"], {

executor/tsconfig.json+0−1

@@ -21,7 +21,6 @@ · 20 unmodified lines
21	"lib/*/.ts",	21	"lib/*/.ts",
22	"scripts/*/.ts",	22	"scripts/*/.ts",
23	"executor.ts",	23	"executor.ts",
24	"mcp-gateway.ts",
25	"vscode-elicitation-server.ts"	24	"vscode-elicitation-server.ts"
26	]	25	]
27	}	26	}