lael-labs/executor

apps/cli/package.json+1−0

@@ -30,6 +30,7 @@ · 29 unmodified lines
30	"@executor-js/runtime-quickjs": "workspace:*",	30	"@executor-js/runtime-quickjs": "workspace:*",
31	"@executor-js/sdk": "workspace:*",	31	"@executor-js/sdk": "workspace:*",
32	"@jitl/quickjs-wasmfile-release-sync": "catalog:",	32	"@jitl/quickjs-wasmfile-release-sync": "catalog:",
		33	"@modelcontextprotocol/client": "2.0.0",
33	"@modelcontextprotocol/sdk": "^1.29.0",	34	"@modelcontextprotocol/sdk": "^1.29.0",
34	"@sentry/bun": "^10.57.0",	35	"@sentry/bun": "^10.57.0",
35	"effect": "catalog:",	36	"effect": "catalog:",

apps/cli/src/main.ts+1−1

@@ -75,7 +75,7 @@ import type { PlatformError } from "effect/PlatformError"; · 74 unmodified lines
75	import * as Effect from "effect/Effect";	75	import * as Effect from "effect/Effect";
76	import * as Option from "effect/Option";	76	import * as Option from "effect/Option";
77	import * as Cause from "effect/Cause";	77	import * as Cause from "effect/Cause";
78	import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";	78	import { StreamableHTTPClientTransport } from "@modelcontextprotocol/client";
79	import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";	79	import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
80	import type { JSONRPCMessage } from "@modelcontextprotocol/sdk/types.js";	80	import type { JSONRPCMessage } from "@modelcontextprotocol/sdk/types.js";
81		81

apps/cloud/src/env-augment.d.ts+2−0

@@ -69,6 +69,8 @@ declare global { · 68 unmodified lines
69	MCP_PAUSED_SESSION_IDLE_TIMEOUT_MS?: string;	69	MCP_PAUSED_SESSION_IDLE_TIMEOUT_MS?: string;
70	/** HMAC key for MCP 2026-07-28 continuation state (32+ byte secret). */	70	/** HMAC key for MCP 2026-07-28 continuation state (32+ byte secret). */
71	MCP_REQUEST_STATE_KEY?: string;	71	MCP_REQUEST_STATE_KEY?: string;
		72	/** Emergency rollback for inbound MCP 2026-07-28 traffic only. */
		73	MCP_2026_07_28_ENABLED?: string;
72	NODE_ENV?: string;	74	NODE_ENV?: string;
73		75
74	// Shared with frontend	76	// Shared with frontend

apps/cloud/src/mcp/agent-handler.ts+4−0

 import {
   McpAuthProvider,
   jsonRpcErrorBody,
+  mcpModernDisabledResponse,
   defaultMcpResource,
   UNAVAILABLE_RETRY_AFTER_SECONDS,
   type AuthOutcome,
     const parsedBody = await Effect.runPromise(requestBodyFromRequest(request));
     const era = await classifyMcpProtocolEra(request, parsedBody);
     if (era === "modern") {
+      if (env.MCP_2026_07_28_ENABLED === "false") {
+        return mcpModernDisabledResponse();
+      }
       const resource = resourceFromPath(request);
       const props = await runTraced(
         request,

apps/cloud/wrangler.jsonc+3−0

   // secret for both with `wrangler secret put MCP_REQUEST_STATE_KEY`.
   // It must never be placed in `vars` or generated independently per isolate.
   "vars": {
+    // MCP_2026_07_28_ENABLED is intentionally absent: unset enables modern
+    // inbound serving. Set the Worker var to "false" for emergency rollback;
+    // legacy serving remains available.
     "VITE_PUBLIC_SITE_URL": "https://executor.sh",
     "VITE_PUBLIC_POSTHOG_KEY": "phc_nNLrNMALpRsfrEkZovUkfMxYbcJvHnsJHeoSPavprgLL",
     // Browser OTLP spans → same-origin, forwarded to Axiom by the worker

apps/host-cloudflare/src/config.ts+2−0

   readonly EXECUTOR_SECRET_KEY?: string;
   /** HMAC key for MCP 2026-07-28 continuation state (32+ byte secret). */
   readonly MCP_REQUEST_STATE_KEY?: string;
+  /** Emergency rollback for inbound MCP 2026-07-28 traffic only. */
+  readonly MCP_2026_07_28_ENABLED?: string;
   readonly ALLOW_LOCAL_NETWORK?: string;
   readonly VITE_PUBLIC_SITE_URL?: string;
   /**

apps/host-cloudflare/src/mcp/agent-handler.ts+4−0

 import {
   McpAuthProvider,
   jsonRpcErrorBody,
+  mcpModernDisabledResponse,
   defaultMcpResource,
   type AuthOutcome,
   type Principal,
     const parsedBody = await Effect.runPromise(requestBodyFromRequest(request));
     const era = await classifyMcpProtocolEra(request, parsedBody);
     if (era === "modern") {
+      if (env.MCP_2026_07_28_ENABLED === "false") {
+        return mcpModernDisabledResponse();
+      }
       const props = await Effect.runPromise(propsForPrincipal(request, outcome.principal));
       (ctx as ExecutionContext & { props?: McpSessionProps }).props = props;
       const forwarded = withVerifiedIdentityHeaders(

apps/host-cloudflare/wrangler.jsonc+3−0

   // MCP key is a deployment prerequisite shared by Worker and session DOs;
   // never generate it independently per isolate.
   "vars": {
+    // MCP_2026_07_28_ENABLED is intentionally absent: unset enables modern
+    // inbound serving. Set the Worker var to "false" for emergency rollback;
+    // legacy serving remains available.
     "ACCESS_NAME_CLAIM": "name",
     "ACCESS_GROUPS_CLAIM": "groups",
     // Never preserve a production dev-auth override through keep_vars.

apps/host-selfhost/src/app.ts+6−1

   // ---- the in-process MCP serving seams (+ shutdown hook) ----------------
   // Pass the pinned public origin so browser-approval URLs are reachable behind
   // a reverse proxy (not the internal 127.0.0.1 bind from the request URL).
-  const mcp = makeSelfHostMcpSeams(dbHandle, betterAuth, config.webBaseUrl);
+  const mcp = makeSelfHostMcpSeams(
+    dbHandle,
+    betterAuth,
+    config.webBaseUrl,
+    config.mcp20260728Enabled,
+  );
   // CLI device-login discovery (`executor login`). Points the CLI at Better
   // Auth's device endpoints; `requestFormat: "json"` because those endpoints

apps/host-selfhost/src/config.ts+3−0

    * internal network unless an operator opts in.
    */
   readonly allowLocalNetwork: boolean;
+  /** Emergency rollback for inbound MCP 2026-07-28 traffic only. */
+  readonly mcp20260728Enabled: boolean;
   // Better Auth session secret. Always resolved (env, else generated + persisted
   // under the data dir) so a single-container deploy boots with no env; the auth
   // layer still validates an explicitly-set env secret is long enough.
     dbPath: process.env.EXECUTOR_DB_PATH ?? join(dataDir, "data.db"),
     webBaseUrl: resolveWebBaseUrl(port),
     allowLocalNetwork: process.env.EXECUTOR_ALLOW_LOCAL_NETWORK === "true",
+    mcp20260728Enabled: process.env.MCP_2026_07_28_ENABLED !== "false",
     authSecret: resolveAuthSecret(),
     bootstrapAdminEmail: process.env.EXECUTOR_BOOTSTRAP_ADMIN_EMAIL,
     bootstrapAdminPassword: process.env.EXECUTOR_BOOTSTRAP_ADMIN_PASSWORD,

apps/host-selfhost/src/mcp/index.ts+2−1

   dbHandle: SelfHostDbHandle,
   betterAuth: BetterAuthHandle,
   webBaseUrl?: string,
+  modernEnabled = true,
 ): SelfHostMcpSeams => {
   const sessionStore = makeSelfHostMcpSessionStore(dbHandle, webBaseUrl);
   const auth: Layer.Layer<McpAuthProvider, never, IdentityProvider> = selfHostMcpAuth.pipe(
   return {
     auth,
     sessions: selfHostMcpSessions(sessionStore),
-    modern: makeSelfHostMcpModernServerBuilder(dbHandle),
+    modern: makeSelfHostMcpModernServerBuilder(dbHandle, modernEnabled),
     reporter: selfHostMcpReporter,
     approvalHandler: makeApprovalHandler(sessionStore, betterAuth),
     close: sessionStore.close,

apps/host-selfhost/src/mcp/session-store.ts+2−0

 /** Build the stateless MCP server seam over the same self-host stack/config. */
 export const makeSelfHostMcpModernServerBuilder = (
   db: SelfHostDbHandle,
+  enabled = true,
 ): Layer.Layer<McpModernServerBuilder> =>
   Layer.succeed(McpModernServerBuilder)({
+    enabled,
     build: makeMcpBuildServer(
       SelfHostExecutionStackLayer.pipe(Layer.provide(Layer.succeed(SelfHostDb)(db))),
       {

apps/local/src/main.ts+1−0

@@ -119,6 +119,7 @@ export const createServerHandlers = async (token: string): Promise<ServerHandler · 118 unmodified lines
119	localAnalytics.record(`artifact_${action}`, { via: "agent" }),	119	localAnalytics.record(`artifact_${action}`, { via: "agent" }),
120	};	120	};
121	mcp = createMcpRequestHandler({	121	mcp = createMcpRequestHandler({
		122	modernEnabled: process.env.MCP_2026_07_28_ENABLED !== "false",
122	defaultConfig: {	123	defaultConfig: {
123	engine,	124	engine,
124	artifacts: executor.artifacts,	125	artifacts: executor.artifacts,

apps/local/src/mcp-modern.test.ts+52−0

@@ -51,4 +51,56 @@ describe("local modern MCP HTTP", () => { · 50 unmodified lines
51	await mcp.close();	51	await mcp.close();
52	}	52	}
53	});	53	});
		54
		55	it("rejects a pinned modern client with the unsupported-version protocol error", async () => {
		56	const mcp = createMcpRequestHandler({ defaultConfig: { engine }, modernEnabled: false });
		57	const transport = new StreamableHTTPClientTransport(new URL("http://local.test/mcp"), {
		58	fetch: (input, init) =>
		59	mcp.handleRequest(
		60	input instanceof Request ? new Request(input, init) : new Request(input.toString(), init),
		61	),
		62	});
		63	const client = new Client(
		64	{ name: "local-modern-disabled-test", version: "1.0.0" },
		65	{ capabilities: {}, versionNegotiation: { mode: { pin: "2026-07-28" } } },
		66	);
		67
		68	// oxlint-disable-next-line executor/no-try-catch-or-throw -- test boundary: always close a client whose pinned negotiation is expected to fail
		69	try {
		70	await expect(client.connect(transport)).rejects.toThrow(/version negotiation failed/i);
		71	} finally {
		72	await client.close();
		73	await mcp.close();
		74	}
		75	});
		76
		77	it("lets an auto-mode v2 client fall back to legacy when modern inbound is disabled", async () => {
		78	const mcp = createMcpRequestHandler({ defaultConfig: { engine }, modernEnabled: false });
		79	const transport = new StreamableHTTPClientTransport(new URL("http://local.test/mcp"), {
		80	fetch: (input, init) =>
		81	mcp.handleRequest(
		82	input instanceof Request ? new Request(input, init) : new Request(input.toString(), init),
		83	),
		84	});
		85	const client = new Client(
		86	{ name: "local-auto-fallback-test", version: "1.0.0" },
		87	{ capabilities: {}, versionNegotiation: { mode: "auto" } },
		88	);
		89
		90	await client.connect(transport);
		91	// oxlint-disable-next-line executor/no-try-catch-or-throw -- test boundary: always close the fallback client and local handler
		92	try {
		93	expect(client.getProtocolEra()).toBe("legacy");
		94	expect((await client.listTools()).tools.map(({ name }) => name)).toContain("execute");
		95	const result = await client.callTool({
		96	name: "execute",
		97	arguments: { code: "3 + 4" },
		98	});
		99	expect(result.content).toEqual([{ type: "text", text: "ran: 3 + 4" }]);
		100	expect(transport.sessionId).toBeTruthy();
		101	} finally {
		102	await client.close();
		103	await mcp.close();
		104	}
		105	});
54	});	106	});

apps/local/src/mcp.ts+18−0

 import {
   defaultMcpResource,
   jsonRpcErrorBody,
+  mcpModernDisabledResponse,
   mcpResourceKey,
   type McpResource,
 } from "@executor-js/host-mcp";
   appsEnabledForClientCapabilities,
   buildMcpServer,
   clientCapabilitiesFromRequest,
+  mcpRequestStateBindingFromBody,
   requestBodyFromRequest,
   type ExecutorMcpToolConfig,
 } from "@executor-js/host-mcp/tool-server";
 export interface LocalMcpRequestHandlerConfig {
   readonly defaultConfig: ExecutorMcpToolConfig;
+  /** Emergency rollback for inbound MCP 2026-07-28 traffic only. */
+  readonly modernEnabled?: boolean;
   readonly createConfigForResource?: (
     resource: McpResource,
   ) => Promise<LocalMcpServerConfig> | LocalMcpServerConfig;
   const sessionEngines = new Map<string, AnyExecutionEngine>();
   const sessionClosers = new Map<string, () => Promise<void>>();
   const modernHandlers = new Map<string, McpHttpHandler>();
+  const modernRequestBodies = new WeakMap<Request, unknown>();
   const approvals = makeInProcessBrowserApprovalStore();
   const defaultEngine = engineFromConfig(handlerConfig.defaultConfig);
   let requestStateSigningKey: Uint8Array | undefined;
           // oxlint-disable-next-line executor/no-effect-escape-hatch -- boundary: the third-party McpServerFactory Promise contract has no typed failure channel; missing documented request context is an SDK defect
           return Effect.runPromise(Effect.die("Modern MCP request context has no request"));
         }
+        const parsedBody = modernRequestBodies.get(request);
         return Effect.runPromise(
           Effect.gen(function* () {
             const resourceConfig = yield* Effect.promise(() => configForResource(resource));
             const clientCapabilities = yield* clientCapabilitiesFromRequest(request);
+            const requestStateBinding = yield* Effect.promise(() =>
+              mcpRequestStateBindingFromBody({
+                body: parsedBody,
+                principal: "local",
+                resource,
+              }),
+            );
             const server = yield* buildMcpServer({
               ...resourceConfig.config,
               artifactsEnabled: readArtifactsEnabled(request),
               appsEnabled: appsEnabledForClientCapabilities(clientCapabilities),
               requestStateSigningKey: signingKey(),
               requestStatePrincipal: "local",
+              ...(requestStateBinding === null ? {} : { requestStateBinding }),
             });
             if (resourceConfig.close) {
               const closeServer = server.close.bind(server);
       const resource = resourceFromRequest(request);
       if (!resource) return jsonError(404, -32001, "MCP resource not found");
       if (!(await isLegacyRequest(request))) {
+        if (handlerConfig.modernEnabled === false) {
+          return mcpModernDisabledResponse({ cors: false });
+        }
         const parsedBody = await Effect.runPromise(requestBodyFromRequest(request));
+        modernRequestBodies.set(request, parsedBody);
         return modernHandlerFor(resource).fetch(request, { parsedBody });
       }
       const sessionId = request.headers.get("mcp-session-id");

bun.lock+1−0

@@ -43,6 +43,7 @@ · 42 unmodified lines
43	"@executor-js/runtime-quickjs": "workspace:*",	43	"@executor-js/runtime-quickjs": "workspace:*",
44	"@executor-js/sdk": "workspace:*",	44	"@executor-js/sdk": "workspace:*",
45	"@jitl/quickjs-wasmfile-release-sync": "catalog:",	45	"@jitl/quickjs-wasmfile-release-sync": "catalog:",
		46	"@modelcontextprotocol/client": "2.0.0",
46	"@modelcontextprotocol/sdk": "^1.29.0",	47	"@modelcontextprotocol/sdk": "^1.29.0",
47	"@sentry/bun": "^10.57.0",	48	"@sentry/bun": "^10.57.0",
48	"effect": "catalog:",	49	"effect": "catalog:",

e2e/local/cli-mcp-protocol.test.ts+117−0

@@ -0,0 +1,117 @@
	1	// Regression for #1449: a modern MCP client starts stdio negotiation with
	2	// `server/discover`, before `initialize`. This crosses the real CLI bridge:
	3	//
	4	// v2/v1 stdio client -> `executor mcp` -> local daemon HTTP MCP endpoint
	5	//
	6	// It reconnects with the v1 SDK too, proving discovery forwarding does not
	7	// regress established legacy stdio clients.
	8	import { expect } from "@effect/vitest";
	9	import { Client as ModernClient } from "@modelcontextprotocol/client";
	10	import { StdioClientTransport as ModernStdioClientTransport } from "@modelcontextprotocol/client/stdio";
	11	import { Client as LegacyClient } from "@modelcontextprotocol/sdk/client/index.js";
	12	import { StdioClientTransport as LegacyStdioClientTransport } from "@modelcontextprotocol/sdk/client/stdio.js";
	13	import { Effect } from "effect";
	14	import { mkdtempSync, readFileSync, rmSync } from "node:fs";
	15	import { tmpdir } from "node:os";
	16	import { join } from "node:path";
	17	import { fileURLToPath } from "node:url";
	18
	19	import { scenario } from "../src/scenario";
	20
	21	const repoRoot = fileURLToPath(new URL("../../", import.meta.url));
	22	const testScope = join(repoRoot, "apps/local");
	23
	24	const bridgeCommand = (dataDir: string) => ({
	25	command: "bun",
	26	args: ["run", "dev:cli", "mcp", "--scope", testScope],
	27	cwd: repoRoot,
	28	env: {
	29	...process.env,
	30	EXECUTOR_DATA_DIR: dataDir,
	31	EXECUTOR_DISABLE_INTEGRATIONS_FETCH: "1",
	32	} as Record<string, string>,
	33	stderr: "pipe" as const,
	34	});
	35
	36	const stopAutoSpawnedDaemon = (dataDir: string): void => {
	37	// The bridge is transient, while its auto-started daemon is detached. Reap
	38	// that owner before deleting this scenario's private data directory.
	39	// oxlint-disable-next-line executor/no-try-catch-or-throw -- cleanup tolerates a bridge that failed before writing its manifest
	40	try {
	41	const manifest = JSON.parse(
	42	readFileSync(join(dataDir, "server-control", "server.json"), "utf8"),
	43	) as { readonly pid?: number };
	44	if (manifest.pid) process.kill(manifest.pid, "SIGTERM");
	45	} catch {
	46	// No manifest means there is no auto-started daemon to stop.
	47	}
	48	};
	49
	50	const withTempData = Effect.acquireRelease(
	51	Effect.sync(() => {
	52	const root = mkdtempSync(join(tmpdir(), "executor-mcp-protocol-"));
	53	return { root, dataDir: join(root, "data") };
	54	}),
	55	({ root, dataDir }) =>
	56	Effect.sync(() => {
	57	stopAutoSpawnedDaemon(dataDir);
	58	rmSync(root, { recursive: true, force: true });
	59	}),
	60	);
	61
	62	scenario(
	63	"Local CLI MCP · modern discovery and legacy initialize cross the stdio bridge",
	64	{ timeout: 240_000 },
	65	Effect.gen(function* () {
	66	const { dataDir } = yield* withTempData;
	67
	68	const modernTransport = new ModernStdioClientTransport(bridgeCommand(dataDir));
	69	const modernClient = new ModernClient(
	70	{ name: "executor-cli-modern-e2e", version: "1.0.0" },
	71	{ versionNegotiation: { mode: "auto" } },
	72	);
	73
	74	yield* Effect.promise(async () => {
	75	// oxlint-disable-next-line executor/no-try-catch-or-throw -- boundary: always reap the real CLI child when an assertion fails
	76	try {
	77	await modernClient.connect(modernTransport);
	78	expect(modernClient.getProtocolEra()).toBe("modern");
	79	expect((await modernClient.listTools()).tools.map(({ name }) => name)).toContain("execute");
	80	const executed = await modernClient.callTool({
	81	name: "execute",
	82	arguments: { code: "return 42" },
	83	});
	84	expect(executed.structuredContent).toMatchObject({
	85	status: "completed",
	86	result: 42,
	87	});
	88	} finally {
	89	await modernClient.close();
	90	}
	91	});
	92
	93	const legacyTransport = new LegacyStdioClientTransport(bridgeCommand(dataDir));
	94	const legacyClient = new LegacyClient({
	95	name: "executor-cli-legacy-e2e",
	96	version: "1.0.0",
	97	});
	98
	99	yield* Effect.promise(async () => {
	100	// oxlint-disable-next-line executor/no-try-catch-or-throw -- boundary: always reap the real CLI child when an assertion fails
	101	try {
	102	await legacyClient.connect(legacyTransport);
	103	expect((await legacyClient.listTools()).tools.map(({ name }) => name)).toContain("execute");
	104	const executed = await legacyClient.callTool({
	105	name: "execute",
	106	arguments: { code: "return 42" },
	107	});
	108	expect(executed.structuredContent).toMatchObject({
	109	status: "completed",
	110	result: 42,
	111	});
	112	} finally {
	113	await legacyClient.close();
	114	}
	115	});
	116	}).pipe(Effect.scoped),
	117	);

packages/hosts/cloudflare/src/mcp/agent-session-durable-object.ts+25−27

 import {
   appsEnabledForClientCapabilities,
   clientCapabilitiesFromRequestBody,
+  mcpRequestStateBindingFromBody,
   PAUSED_APPROVAL_TIMEOUT_MS,
   formatMcpExecutionOutcome,
   mcpRequestStatePrincipal,
   readonly appsEnabled: boolean;
   readonly requestStateSigningKey: Uint8Array | string;
   readonly requestStatePrincipal: string;
+  readonly requestStateBinding?: string;
 }
 /** Long-lived DO execution runtime shared by per-request MCP servers. */
       }),
     );
     await Effect.runPromise(this.closeRuntime());
-<<<<<<< HEAD
-    await Effect.runPromise(
-      Effect.all([
-        Effect.ignore(Effect.tryPromise(() => this.ctx.storage.deleteAlarm())),
-        Effect.ignore(
-          Effect.tryPromise(() =>
-            this.ctx.storage.delete([LEGACY_AGENT_LAST_ACTIVITY_KEY, MODERN_LAST_ACTIVITY_KEY]),
-          ),
-        ),
-      ]),
-    );
-=======
     const activityKey =
-      this.runtimeKind === "modern" ? MODERN_LAST_ACTIVITY_KEY : LEGACY_V2_LAST_ACTIVITY_KEY;
+      this.runtimeKind === "modern" ? MODERN_LAST_ACTIVITY_KEY : LEGACY_AGENT_LAST_ACTIVITY_KEY;
     const cleared = await this.ctx.storage.transaction(async (transaction) => {
       const current = await transaction.get<number>(activityKey);
       if (current !== input.lastActivityMs) return false;
-      await transaction.delete([LEGACY_V2_LAST_ACTIVITY_KEY, MODERN_LAST_ACTIVITY_KEY]);
+      await transaction.delete([LEGACY_AGENT_LAST_ACTIVITY_KEY, MODERN_LAST_ACTIVITY_KEY]);
       await transaction.deleteAlarm();
       return true;
     });
     if (cleared) this.lastActivityMs = 0;
->>>>>>> d62e666df (Fix session-id parsing, stranded-stream replay, priming, and restore races)
   }
   private resolveAndStoreSessionMeta(token: McpSessionInit) {
         const propagation = self.modernRequestPropagation.get(request);
         const capabilities = clientCapabilitiesFromRequestBody(parsedBody);
         return Effect.runPromise(
-          runtime
+          Effect.gen(function* () {
-            .buildServer({
+            const requestStatePrincipal = mcpRequestStatePrincipal({
+              accountId: sessionMeta.userId,
+              organizationId: sessionMeta.organizationId,
+            });
+            const requestStateBinding = yield* Effect.promise(() =>
+              mcpRequestStateBindingFromBody({
+                body: parsedBody,
+                principal: requestStatePrincipal,
+                resource: sessionMeta.resource,
+              }),
+            );
+            return yield* runtime.buildServer({
               appsEnabled: appsEnabledForClientCapabilities(capabilities),
               requestStateSigningKey: self.modernRequestStateSigningKey(),
-              requestStatePrincipal: mcpRequestStatePrincipal({
+              requestStatePrincipal,
-                accountId: sessionMeta.userId,
+              ...(requestStateBinding === null ? {} : { requestStateBinding }),
-                organizationId: sessionMeta.organizationId,
+            });
-              }),
+          }).pipe(
-            })
+            (effect) => self.withTelemetry(effect, propagation),
-            .pipe(
+            // oxlint-disable-next-line executor/no-effect-escape-hatch -- boundary: the third-party factory Promise can only reject
-              (effect) => self.withTelemetry(effect, propagation),
+            Effect.orDie,
-              // oxlint-disable-next-line executor/no-effect-escape-hatch -- boundary: the third-party factory Promise can only reject
+          ),
-              Effect.orDie,
-            ),
         );
       },
       { legacy: "reject" },

packages/hosts/cloudflare/src/mcp/modern-request-router.test.ts+69−7

@@ -6,9 +6,14 @@ import type { ExecutionEngine } from "@executor-js/execution"; · 5 unmodified lines
6	import {	6	import {
7	defaultMcpResource,	7	defaultMcpResource,
8	type McpModernServerBuilder,	8	type McpModernServerBuilder,
		9	type McpResource,
9	type Principal,	10	type Principal,
10	} from "@executor-js/host-mcp";	11	} from "@executor-js/host-mcp";
11	import { buildMcpServer, mcpRequestStatePrincipal } from "@executor-js/host-mcp/tool-server";	12	import {
		13	buildMcpServer,
		14	mcpRequestStateBindingFromBody,
		15	mcpRequestStatePrincipal,
		16	} from "@executor-js/host-mcp/tool-server";
12		17
13	import type { McpSessionProps } from "./agent-session-durable-object";	18	import type { McpSessionProps } from "./agent-session-durable-object";
14	import {	19	import {
@@ -168,13 +173,14 @@ const dispatch = async (input: { · 153 unmodified lines
168	readonly sessions: MemorySessions;	173	readonly sessions: MemorySessions;
169	readonly directory: MemoryDirectory;	174	readonly directory: MemoryDirectory;
170	readonly builder: McpModernServerBuilder["Service"];	175	readonly builder: McpModernServerBuilder["Service"];
		176	readonly resource?: McpResource;
171	}) => {	177	}) => {
172	const request = modernRequest(input.body);	178	const request = modernRequest(input.body);
173	return makeMcpModernRequestRouter().fetch({	179	return makeMcpModernRequestRouter().fetch({
174	request,	180	request,
175	parsedBody: input.body,	181	parsedBody: input.body,
176	principal,	182	principal,
177	resource: defaultMcpResource,	183	resource: input.resource ?? defaultMcpResource,
178	props,	184	props,
179	requestStateSigningKey: REQUEST_STATE_KEY,	185	requestStateSigningKey: REQUEST_STATE_KEY,
180	builder: input.builder,	186	builder: input.builder,
@@ -183,12 +189,29 @@ const dispatch = async (input: { · 2 unmodified lines
183	});	189	});
184	};	190	};
185		191
186	const mintRequestState = async (executionId: string, ttlSeconds = 60): Promise<string> => {	192	const mintRequestState = async (
187	const binding = `tools/call\u0000${mcpRequestStatePrincipal(principal)}`;	193	executionId: string,
		194	options: {
		195	readonly code?: string;
		196	readonly resource?: McpResource;
		197	readonly ttlSeconds?: number;
		198	} = {},
		199	): Promise<string> => {
		200	const body = modernBody({
		201	method: "tools/call",
		202	name: "execute",
		203	arguments: { code: options.code ?? "1 + 1" },
		204	});
		205	const binding = await mcpRequestStateBindingFromBody({
		206	body,
		207	principal: mcpRequestStatePrincipal(principal),
		208	resource: options.resource ?? defaultMcpResource,
		209	});
		210	expect(binding).not.toBeNull();
188	const codec = createRequestStateCodec<{ readonly executionId: string }>({	211	const codec = createRequestStateCodec<{ readonly executionId: string }>({
189	key: REQUEST_STATE_KEY,	212	key: REQUEST_STATE_KEY,
190	ttlSeconds,	213	ttlSeconds: options.ttlSeconds ?? 60,
191	bind: () => binding,	214	bind: () => binding ?? "",
192	});	215	});
193	const encoded: unknown = await Reflect.apply(codec.mint, codec, [{ executionId }, {}]);	216	const encoded: unknown = await Reflect.apply(codec.mint, codec, [{ executionId }, {}]);
194	return typeof encoded === "string" ? encoded : "";	217	return typeof encoded === "string" ? encoded : "";
@@ -392,7 +415,7 @@ describe("modern Cloudflare MCP worker routing", () => { · 197 unmodified lines
392	const valid = await mintRequestState("exec-invalid");	415	const valid = await mintRequestState("exec-invalid");
393	const middle = Math.floor(valid.length / 2);	416	const middle = Math.floor(valid.length / 2);
394	const tampered = `${valid.slice(0, middle)}${valid[middle] === "A" ? "B" : "A"}${valid.slice(middle + 1)}`;	417	const tampered = `${valid.slice(0, middle)}${valid[middle] === "A" ? "B" : "A"}${valid.slice(middle + 1)}`;
395	const expired = await mintRequestState("exec-expired", -1);	418	const expired = await mintRequestState("exec-expired", { ttlSeconds: -1 });
396		419
397	for (const requestState of [tampered, expired]) {	420	for (const requestState of [tampered, expired]) {
398	const sessions = new MemorySessions();	421	const sessions = new MemorySessions();
@@ -414,4 +437,43 @@ describe("modern Cloudflare MCP worker routing", () => { · 15 unmodified lines
414	expect(sessions.forwarded).toEqual([]);	437	expect(sessions.forwarded).toEqual([]);
415	}	438	}
416	});	439	});
		440
		441	it("rejects continuation state when the resource or code digest binding changes", async () => {
		442	const requestState = await mintRequestState("exec-bound");
		443	const cases = [
		444	{
		445	body: modernBody({
		446	method: "tools/call",
		447	name: "execute",
		448	arguments: { code: "different code" },
		449	requestState,
		450	}),
		451	resource: defaultMcpResource,
		452	},
		453	{
		454	body: modernBody({
		455	method: "tools/call",
		456	name: "execute",
		457	arguments: { code: "1 + 1" },
		458	requestState,
		459	}),
		460	resource: { kind: "toolkit", slug: "other" } as const,
		461	},
		462	];
		463
		464	for (const { body, resource } of cases) {
		465	const sessions = new MemorySessions();
		466	const response = await dispatch({
		467	body,
		468	resource,
		469	sessions,
		470	directory: new MemoryDirectory(),
		471	builder: makeBuilder({ count: 0 }),
		472	});
		473
		474	expect(await response.json()).toMatchObject({ error: { code: -32602 } });
		475	expect(sessions.uniqueIds).toBe(0);
		476	expect(sessions.forwarded).toEqual([]);
		477	}
		478	});
417	});	479	});

packages/hosts/cloudflare/src/mcp/modern-request-router.ts+19−6

 import {
   appsEnabledForClientCapabilities,
   clientCapabilitiesFromRequestBody,
+  mcpRequestStateBindingFromBody,
   mcpRequestStatePrincipal,
   verifyNativeRequestState,
 } from "@executor-js/host-mcp/tool-server";
         }
         const capabilities = clientCapabilitiesFromRequestBody(inputs.parsedBody);
         return Effect.runPromise(
-          inputs.builder.build(inputs.principal, {
+          Effect.gen(function* () {
-            resource,
+            const requestStatePrincipal = mcpRequestStatePrincipal(inputs.principal);
-            appsEnabled: appsEnabledForClientCapabilities(capabilities),
+            const requestStateBinding = yield* Effect.promise(() =>
-            requestStateSigningKey: inputs.requestStateSigningKey,
+              mcpRequestStateBindingFromBody({
-            requestStatePrincipal: mcpRequestStatePrincipal(inputs.principal),
+                body: inputs.parsedBody,
+                principal: requestStatePrincipal,
+                resource,
+              }),
+            );
+            return yield* inputs.builder.build(inputs.principal, {
+              resource,
+              appsEnabled: appsEnabledForClientCapabilities(capabilities),
+              requestStateSigningKey: inputs.requestStateSigningKey,
+              requestStatePrincipal,
+              ...(requestStateBinding === null ? {} : { requestStateBinding }),
+            });
           }),
         );
       },
         const verified = await Effect.runPromiseExit(
           verifyNativeRequestState({
             state: call.params.requestState,
-            method: call.method,
+            body: input.parsedBody,
+            resource: input.resource,
             requestStateSigningKey: input.requestStateSigningKey,
             requestStatePrincipal: mcpRequestStatePrincipal(input.principal),
           }),

packages/hosts/mcp/src/envelope.test.ts+21−0

@@ -231,6 +231,27 @@ describe("McpServingRoutes envelope", () => { · 230 unmodified lines
231	expect(response.headers.get("www-authenticate")).toBe(challenge);	231	expect(response.headers.get("www-authenticate")).toBe(challenge);
232	});	232	});
233		233
		234	it("gracefully rejects modern discovery when inbound 2026-07-28 is disabled", async () => {
		235	const DisabledModernBuilder = Layer.succeed(McpModernServerBuilder)({
		236	enabled: false,
		237	build: () => Effect.die("disabled modern builder should not run"),
		238	});
		239	const handler = buildHandler(
		240	OkStoreLive,
		241	McpErrorReporterNoop,
		242	AuthProviderLive,
		243	DisabledModernBuilder,
		244	);
		245
		246	const response = await handler(modernRequest("https://host.test/mcp"));
		247	expect(response.status).toBe(400);
		248	expect(await response.json()).toEqual({
		249	jsonrpc: "2.0",
		250	error: { code: -32022, message: "MCP 2026-07-28 support is disabled" },
		251	id: null,
		252	});
		253	});
		254
234	it("404s a modern request whose toolkit route is not served", async () => {	255	it("404s a modern request whose toolkit route is not served", async () => {
235	const handler = buildHandler(OkStoreLive, McpErrorReporterNoop);	256	const handler = buildHandler(OkStoreLive, McpErrorReporterNoop);
236	const response = await handler(modernRequest("https://host.test/mcp/toolkits/unknown/extra"));	257	const response = await handler(modernRequest("https://host.test/mcp/toolkits/unknown/extra"));

packages/hosts/mcp/src/envelope.ts+20−2

 import {
   appsEnabledForClientCapabilities,
   clientCapabilitiesFromRequest,
+  mcpRequestStateBindingFromBody,
   mcpRequestStatePrincipal,
   requestBodyFromRequest,
 } from "./tool-server";
   });
 };
+/** Graceful rollback response that lets auto-negotiating v2 clients try legacy. */
+export const mcpModernDisabledResponse = (opts?: { readonly cors?: boolean }): Response =>
+  jsonRpcErrorBody(400, -32022, "MCP 2026-07-28 support is disabled", opts);
 /**
  * Advertised on transient-auth 503s (`Unavailable` outcomes) so clients back
  * off before retrying. Short: upstream auth-infra blips (JWKS fetch, IdP
 interface ModernRequestInputs {
   readonly builder: McpModernServerBuilder["Service"];
+  readonly parsedBody: unknown;
   readonly principal: Principal;
 }
         return Effect.runPromise(
           Effect.gen(function* () {
             const clientCapabilities = yield* clientCapabilitiesFromRequest(request);
+            const requestStatePrincipal = mcpRequestStatePrincipal(inputs.principal);
+            const requestStateBinding = yield* Effect.promise(() =>
+              mcpRequestStateBindingFromBody({
+                body: inputs.parsedBody,
+                principal: requestStatePrincipal,
+                resource,
+              }),
+            );
             return yield* inputs.builder.build(inputs.principal, {
               resource,
               appsEnabled: appsEnabledForClientCapabilities(clientCapabilities),
               requestStateSigningKey: getSigningKey(),
-              requestStatePrincipal: mcpRequestStatePrincipal(inputs.principal),
+              requestStatePrincipal,
+              ...(requestStateBinding === null ? {} : { requestStateBinding }),
             });
           }),
         );
   return {
     fetch: async (request, principal, resource, builder) => {
-      requestInputs.set(request, { builder, principal });
       const parsedBody = await Effect.runPromise(requestBodyFromRequest(request));
+      requestInputs.set(request, { builder, parsedBody, principal });
       return handlerFor(resource).fetch(request, { parsedBody });
     },
   };
     if (!(yield* Effect.promise(() => isLegacyRequest(request)))) {
       const builder = yield* McpModernServerBuilder;
+      if (builder.enabled === false) {
+        return fromWebResponse(mcpModernDisabledResponse());
+      }
       const response = yield* Effect.promise(() =>
         modern.fetch(request, principal, resource, builder),
       );

packages/hosts/mcp/src/index.ts+1−0

@@ -41,5 +41,6 @@ export { · 40 unmodified lines
41	McpServingRoutes,	41	McpServingRoutes,
42	McpDiscoveryRoutes,	42	McpDiscoveryRoutes,
43	jsonRpcErrorBody,	43	jsonRpcErrorBody,
		44	mcpModernDisabledResponse,
44	UNAVAILABLE_RETRY_AFTER_SECONDS,	45	UNAVAILABLE_RETRY_AFTER_SECONDS,
45	} from "./envelope";	46	} from "./envelope";

packages/hosts/mcp/src/seams.ts+4−0

   readonly requestStateSigningKey: Uint8Array | string;
   /** Stable authenticated-owner key bound into signed continuation state. */
   readonly requestStatePrincipal: string;
+  /** Closed resource/tool/code binding for this parsed modern request. */
+  readonly requestStateBinding?: string;
 }
 /**
 export class McpModernServerBuilder extends Context.Service<
   McpModernServerBuilder,
   {
+    /** Inbound-only emergency switch. Unset means modern serving is enabled. */
+    readonly enabled?: boolean;
     readonly build: (
       principal: Principal,
       options: McpModernServerBuildOptions,

packages/hosts/mcp/src/tool-server-protocol.test.ts+56−11

 import { Effect } from "effect";
 import type { ExecutionEngine, ExecutionResult, ResumeResponse } from "@executor-js/execution";
+import { defaultMcpResource, type McpResource } from "./seams";
 import { FormElicitation, ToolAddress } from "@executor-js/sdk";
-import { appsEnabledForClientCapabilities, buildMcpServer } from "./tool-server";
+import {
+  appsEnabledForClientCapabilities,
+  buildMcpServer,
+  mcpRequestStateBindingFromBody,
+} from "./tool-server";
 import { RESOURCE_MIME_TYPE, RESOURCE_URI_META_KEY } from "./mcp-apps";
 const REQUEST_STATE_KEY = new Uint8Array(32).fill(7);
   readonly loadAppShellHtml?: () => Promise<string>;
   /** Evaluated per request, so a test can swap principals between rounds. */
   readonly requestStatePrincipal?: () => string;
+  /** Evaluated per request, so a test can swap resources between rounds. */
+  readonly requestStateResource?: () => McpResource;
 };
 const makeStubEngine = (
   run: (client: Client) => Promise<void>,
   options?: { readonly manualInputRequired?: boolean },
 ) => {
+  const requestBodies = new WeakMap<Request, unknown>();
   const handler = createMcpHandler(
-    () =>
+    (context) =>
       Effect.runPromise(
-        buildMcpServer({
+        Effect.gen(function* () {
-          ...config,
+          const requestStatePrincipal = config.requestStatePrincipal?.() ?? "principal-test";
-          requestStateSigningKey: REQUEST_STATE_KEY,
+          const requestStateResource = config.requestStateResource?.() ?? defaultMcpResource;
-          requestStatePrincipal: config.requestStatePrincipal?.() ?? "principal-test",
+          const requestStateBinding = yield* Effect.promise(() =>
+            mcpRequestStateBindingFromBody({
+              body: context.requestInfo ? requestBodies.get(context.requestInfo) : undefined,
+              principal: requestStatePrincipal,
+              resource: requestStateResource,
+            }),
+          );
+          return yield* buildMcpServer({
+            ...config,
+            requestStateSigningKey: REQUEST_STATE_KEY,
+            requestStatePrincipal,
+            ...(requestStateBinding === null ? {} : { requestStateBinding }),
+          });
         }),
       ),
     { legacy: "reject" },
   );
   const transport = new StreamableHTTPClientTransport(new URL("http://executor.test/mcp"), {
-    fetch: (input, init) =>
+    fetch: async (input, init) => {
-      handler.fetch(
+      const request =
-        input instanceof Request ? new Request(input, init) : new Request(input.toString(), init),
+        input instanceof Request ? new Request(input, init) : new Request(input.toString(), init);
-      ),
+      requestBodies.set(request, await request.clone().json());
+      return handler.fetch(request, { parsedBody: requestBodies.get(request) });
+    },
   });
   const client = new Client(
     { name: "executor-protocol-test", version: "1.0.0" },
     );
   });
-  it("rejects a requestState echoed by a different principal", async () => {
+  it("rejects a requestState echoed with a different principal, resource, or code", async () => {
     const request = FormElicitation.make({
       message: "Confirm",
       requestedSchema: {},
     });
     let principal = "user-a";
+    let resource: McpResource = defaultMcpResource;
     await withClient(
       {
         engine,
         appsEnabled: false,
         elicitationMode: { mode: "native" },
         requestStatePrincipal: () => principal,
+        requestStateResource: () => resource,
       },
       async (client) => {
         const first = await manualToolCall(client, {
             requestState: first.requestState,
           }),
         ).rejects.toMatchObject({ code: -32602 });
+        principal = "user-a";
+        resource = { kind: "toolkit", slug: "other" };
+        await expect(
+          manualToolCall(client, {
+            name: "execute",
+            arguments: { code: "await tools.test.echo()" },
+            inputResponses: { elicitation: { action: "accept", content: {} } },
+            requestState: first.requestState,
+          }),
+        ).rejects.toMatchObject({ code: -32602 });
+        resource = defaultMcpResource;
+        await expect(
+          manualToolCall(client, {
+            name: "execute",
+            arguments: { code: "await tools.test.different()" },
+            inputResponses: { elicitation: { action: "accept", content: {} } },
+            requestState: first.requestState,
+          }),
+        ).rejects.toMatchObject({ code: -32602 });
         expect(resumeCalls).toBe(0);
       },
       { manualInputRequired: true },

packages/hosts/mcp/src/tool-server.ts+119−27

@@ -22,6 +22,7 @@ import * as z from "zod/v4"; · 21 unmodified lines
22		22
23	import type { ElicitationRequest } from "@executor-js/sdk";	23	import type { ElicitationRequest } from "@executor-js/sdk";
24		24
		25	import { mcpResourceKey, type McpResource } from "./seams";
25	import {	26	import {
26	getUiCapability,	27	getUiCapability,
27	EXTENSION_ID,	28	EXTENSION_ID,
@@ -61,6 +62,15 @@ const NativeRequestStateSchema = Schema.Struct({ executionId: Schema.String }); · 33 unmodified lines
61	export type NativeRequestState = typeof NativeRequestStateSchema.Type;	62	export type NativeRequestState = typeof NativeRequestStateSchema.Type;
62	const decodeNativeRequestState = Schema.decodeUnknownOption(NativeRequestStateSchema);	63	const decodeNativeRequestState = Schema.decodeUnknownOption(NativeRequestStateSchema);
63		64
		65	const NativeRequestStateCallSchema = Schema.Struct({
		66	method: Schema.Literal("tools/call"),
		67	params: Schema.Struct({
		68	name: Schema.String,
		69	arguments: Schema.Struct({ code: Schema.String }),
		70	}),
		71	});
		72	const decodeNativeRequestStateCall = Schema.decodeUnknownOption(NativeRequestStateCallSchema);
		73
64	type McpServerRequestContext = McpRequestJoinKeys & {	74	type McpServerRequestContext = McpRequestJoinKeys & {
65	readonly serverContext: ServerContext;	75	readonly serverContext: ServerContext;
66	};	76	};
@@ -86,6 +96,8 @@ export type ExecutorMcpServerConfig<E extends Cause.YieldableError = Cause.Yield · 19 unmodified lines
86	* influences authorization. Single-user hosts pass a constant.	96	* influences authorization. Single-user hosts pass a constant.
87	*/	97	*/
88	readonly requestStatePrincipal: string;	98	readonly requestStatePrincipal: string;
		99	/** Closed request binding derived before the modern server is constructed. */
		100	readonly requestStateBinding?: string;
89	/** Lifetime of signed continuation state in seconds; the SDK defaults to ten minutes. */	101	/** Lifetime of signed continuation state in seconds; the SDK defaults to ten minutes. */
90	readonly requestStateTtlSeconds?: number;	102	readonly requestStateTtlSeconds?: number;
91	};	103	};
@@ -101,39 +113,108 @@ export const mcpRequestStatePrincipal = (principal: { · 9 unmodified lines
101	readonly organizationId: string;	113	readonly organizationId: string;
102	}): string => `${principal.accountId}\u0000${principal.organizationId}`;	114	}): string => `${principal.accountId}\u0000${principal.organizationId}`;
103		115
104	const requestStateBinding = (method: string, principal: string): string =>	116	/** Fields whose exact values bind one modern native-elicitation continuation. */
105	`${method}\u0000${principal}`;	117	export interface McpRequestStateBindingInput {
		118	readonly principal: string;
		119	readonly resource: McpResource;
		120	readonly method: string;
		121	readonly toolName: string;
		122	readonly codeDigest: string;
		123	}
		124
		125	/** Build the canonical NUL-separated modern continuation binding. */
		126	export const mcpRequestStateBinding = (input: McpRequestStateBindingInput): string =>
		127	[
		128	input.principal,
		129	mcpResourceKey(input.resource),
		130	input.method,
		131	input.toolName,
		132	input.codeDigest,
		133	].join("\u0000");
		134
		135	/** Return the lowercase SHA-256 digest used to bind an execute code argument. */
		136	export const mcpCodeDigest = async (code: string): Promise<string> => {
		137	const bytes = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(code));
		138	return Array.from(new Uint8Array(bytes), (byte) => byte.toString(16).padStart(2, "0")).join("");
		139	};
		140
		141	/** Derive a continuation binding from an already-parsed modern tools/call body. */
		142	export const mcpRequestStateBindingFromBody = async (input: {
		143	readonly body: unknown;
		144	readonly principal: string;
		145	readonly resource: McpResource;
		146	}): Promise<string \| null> => {
		147	const call = decodeNativeRequestStateCall(input.body);
		148	if (Option.isNone(call)) return null;
		149	return mcpRequestStateBinding({
		150	principal: input.principal,
		151	resource: input.resource,
		152	method: call.value.method,
		153	toolName: call.value.params.name,
		154	codeDigest: await mcpCodeDigest(call.value.params.arguments.code),
		155	});
		156	};
106		157
107	/** Route-level failure verifying untrusted modern continuation state. */	158	/** Route-level failure verifying untrusted modern continuation state. */
108	export class McpRequestStateVerificationError extends Data.TaggedError(	159	export class McpRequestStateVerificationError extends Data.TaggedError(
109	"McpRequestStateVerificationError",	160	"McpRequestStateVerificationError",
110	)<{ readonly cause: unknown }> {}	161	)<{ readonly cause: unknown }> {}
111		162
		163	class McpRequestStateBindingError extends Data.TaggedError("McpRequestStateBindingError")<{}> {}
		164
		165	const requestStateBindingForContext = (
		166	binding: string \| undefined,
		167	principal: string,
		168	context: ServerContext,
		169	): Promise<string> => {
		170	if (binding !== undefined) return Promise.resolve(binding);
		171	if (context.mcpReq.envelope === undefined) {
		172	return Promise.resolve(`${context.mcpReq.method}\u0000${principal}`);
		173	}
		174	return Effect.runPromise(Effect.fail(new McpRequestStateBindingError()));
		175	};
		176
112	/**	177	/**
113	* Verify and parse a modern continuation before a stateless worker uses its	178	* Verify and parse a modern continuation before a stateless worker uses its
114	* execution id for Durable Object routing.	179	* execution id for Durable Object routing.
115	*/	180	*/
116	export const verifyNativeRequestState = (input: {	181	export const verifyNativeRequestState = (input: {
117	readonly state: string;	182	readonly state: string;
118	readonly method: string;	183	readonly body: unknown;
		184	readonly resource: McpResource;
119	readonly requestStateSigningKey: Uint8Array \| string;	185	readonly requestStateSigningKey: Uint8Array \| string;
120	readonly requestStatePrincipal: string;	186	readonly requestStatePrincipal: string;
121	}): Effect.Effect<NativeRequestState, McpRequestStateVerificationError> => {	187	}): Effect.Effect<NativeRequestState, McpRequestStateVerificationError> =>
122	const codec = createRequestStateCodec<NativeRequestState>({	188	Effect.gen(function* () {
123	key: input.requestStateSigningKey,	189	const binding = yield* Effect.tryPromise({
124	bind: () => requestStateBinding(input.method, input.requestStatePrincipal),	190	try: () =>
125	});	191	mcpRequestStateBindingFromBody({
126	return Effect.tryPromise({	192	body: input.body,
127	// The route-level verifier has no handler context. Its codec binding is a	193	principal: input.requestStatePrincipal,
128	// closed value derived from the already-parsed method and principal, so the	194	resource: input.resource,
129	// SDK callback never observes this inert placeholder.	195	}),
130	try: async () => {	196	catch: (cause) => new McpRequestStateVerificationError({ cause }),
131	const decoded: unknown = await Reflect.apply(codec.verify, codec, [input.state, null]);	197	});
132	return Effect.runPromise(Schema.decodeUnknownEffect(NativeRequestStateSchema)(decoded));	198	if (binding === null) {
133	},	199	return yield* new McpRequestStateVerificationError({
134	catch: (cause) => new McpRequestStateVerificationError({ cause }),	200	cause: "invalid request-state binding",
		201	});
		202	}
		203	const codec = createRequestStateCodec<NativeRequestState>({
		204	key: input.requestStateSigningKey,
		205	bind: () => binding,
		206	});
		207	const decoded = yield* Effect.tryPromise({
		208	// The route-level verifier has no handler context. Its codec binding is a
		209	// closed value derived from the parsed call, resource, and principal, so
		210	// the SDK callback never observes this inert placeholder.
		211	try: () => Reflect.apply(codec.verify, codec, [input.state, null]) as Promise<unknown>,
		212	catch: (cause) => new McpRequestStateVerificationError({ cause }),
		213	});
		214	return yield* Schema.decodeUnknownEffect(NativeRequestStateSchema)(decoded).pipe(
		215	Effect.mapError((cause) => new McpRequestStateVerificationError({ cause })),
		216	);
135	});	217	});
136	};
137		218
138	const isRecord = (value: unknown): value is Record<string, unknown> =>	219	const isRecord = (value: unknown): value is Record<string, unknown> =>
139	typeof value === "object" && value !== null && !Array.isArray(value);	220	typeof value === "object" && value !== null && !Array.isArray(value);
@@ -285,15 +366,21 @@ const createMcpAssembly = <E extends Cause.YieldableError>( · 145 unmodified lines
285	const initialAppsEnabled = sessionful	366	const initialAppsEnabled = sessionful
286	? (config.restoredAppsEnabled ?? config.appsEnabled)	367	? (config.restoredAppsEnabled ?? config.appsEnabled)
287	: config.appsEnabled;	368	: config.appsEnabled;
288	const requestStateCodec = createRequestStateCodec<NativeRequestState>({	369	const requestStateCodec = (binding: string) =>
289	key: config.requestStateSigningKey,	370	createRequestStateCodec<NativeRequestState>({
290	...(config.requestStateTtlSeconds === undefined	371	key: config.requestStateSigningKey,
291	? {}	372	...(config.requestStateTtlSeconds === undefined
292	: { ttlSeconds: config.requestStateTtlSeconds }),	373	? {}
293	bind: (context) => requestStateBinding(context.mcpReq.method, config.requestStatePrincipal),	374	: { ttlSeconds: config.requestStateTtlSeconds }),
294	});	375	bind: () => binding,
		376	});
295	const verifyRequestState = async (state: string, context: ServerContext) => {	377	const verifyRequestState = async (state: string, context: ServerContext) => {
296	const decoded = await requestStateCodec.verify(state, context);	378	const binding = await requestStateBindingForContext(
		379	config.requestStateBinding,
		380	config.requestStatePrincipal,
		381	context,
		382	);
		383	const decoded = await requestStateCodec(binding).verify(state, context);
297	return Effect.runPromise(Schema.decodeUnknownEffect(NativeRequestStateSchema)(decoded));	384	return Effect.runPromise(Schema.decodeUnknownEffect(NativeRequestStateSchema)(decoded));
298	};	385	};
299	const server = new McpServer(	386	const server = new McpServer(
@@ -353,7 +440,12 @@ const createMcpAssembly = <E extends Cause.YieldableError>( · 53 unmodified lines
353	NativeExecutionServices<NativeE, McpServerRequestContext>["executionPaused"]	440	NativeExecutionServices<NativeE, McpServerRequestContext>["executionPaused"]
354	>[0],	441	>[0],
355	): Promise<InputRequiredResult> => {	442	): Promise<InputRequiredResult> => {
356	const requestState = await requestStateCodec.mint(	443	const binding = await requestStateBindingForContext(
		444	config.requestStateBinding,
		445	config.requestStatePrincipal,
		446	services.requestContext.serverContext,
		447	);
		448	const requestState = await requestStateCodec(binding).mint(
357	{ executionId: execution.id },	449	{ executionId: execution.id },
358	services.requestContext.serverContext,	450	services.requestContext.serverContext,
359	);	451	);