Harden requestState binding, add inbound rollback switch, fix CLI bridge era handling

Rhys Sullivan committed 3 months ago

Commit ce870831 parent c25ace226 files · +556 −83Browse files

Showing the changes to apps (15 of 26 files). Show all

Unified · Split

15 files

apps/cli/package.json +1 −0
apps/cli/src/main.ts +1 −1
apps/cloud/src/env-augment.d.ts +2 −0
apps/cloud/src/mcp/agent-handler.ts +4 −0
apps/cloud/wrangler.jsonc +3 −0
apps/host-cloudflare/src/config.ts +2 −0
apps/host-cloudflare/src/mcp/agent-handler.ts +4 −0
apps/host-cloudflare/wrangler.jsonc +3 −0
apps/host-selfhost/src/app.ts +6 −1
apps/host-selfhost/src/config.ts +3 −0
apps/host-selfhost/src/mcp/index.ts +2 −1
apps/host-selfhost/src/mcp/session-store.ts +2 −0
apps/local/src/main.ts +1 −0
apps/local/src/mcp-modern.test.ts +52 −0
apps/local/src/mcp.ts +18 −0

@@ -30,6 +30,7 @@ · 29 unmodified lines
30	"@executor-js/runtime-quickjs": "workspace:*",	30	"@executor-js/runtime-quickjs": "workspace:*",
31	"@executor-js/sdk": "workspace:*",	31	"@executor-js/sdk": "workspace:*",
32	"@jitl/quickjs-wasmfile-release-sync": "catalog:",	32	"@jitl/quickjs-wasmfile-release-sync": "catalog:",
		33	"@modelcontextprotocol/client": "2.0.0",
33	"@modelcontextprotocol/sdk": "^1.29.0",	34	"@modelcontextprotocol/sdk": "^1.29.0",
34	"@sentry/bun": "^10.57.0",	35	"@sentry/bun": "^10.57.0",
35	"effect": "catalog:",	36	"effect": "catalog:",

apps/cli/src/main.ts+1−1

@@ -75,7 +75,7 @@ import type { PlatformError } from "effect/PlatformError"; · 74 unmodified lines
75	import * as Effect from "effect/Effect";	75	import * as Effect from "effect/Effect";
76	import * as Option from "effect/Option";	76	import * as Option from "effect/Option";
77	import * as Cause from "effect/Cause";	77	import * as Cause from "effect/Cause";
78	import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";	78	import { StreamableHTTPClientTransport } from "@modelcontextprotocol/client";
79	import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";	79	import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
80	import type { JSONRPCMessage } from "@modelcontextprotocol/sdk/types.js";	80	import type { JSONRPCMessage } from "@modelcontextprotocol/sdk/types.js";
81		81

apps/cloud/src/env-augment.d.ts+2−0

@@ -69,6 +69,8 @@ declare global { · 68 unmodified lines
69	MCP_PAUSED_SESSION_IDLE_TIMEOUT_MS?: string;	69	MCP_PAUSED_SESSION_IDLE_TIMEOUT_MS?: string;
70	/** HMAC key for MCP 2026-07-28 continuation state (32+ byte secret). */	70	/** HMAC key for MCP 2026-07-28 continuation state (32+ byte secret). */
71	MCP_REQUEST_STATE_KEY?: string;	71	MCP_REQUEST_STATE_KEY?: string;
		72	/** Emergency rollback for inbound MCP 2026-07-28 traffic only. */
		73	MCP_2026_07_28_ENABLED?: string;
72	NODE_ENV?: string;	74	NODE_ENV?: string;
73		75
74	// Shared with frontend	76	// Shared with frontend

apps/cloud/src/mcp/agent-handler.ts+4−0

 import {
   McpAuthProvider,
   jsonRpcErrorBody,
+  mcpModernDisabledResponse,
   defaultMcpResource,
   UNAVAILABLE_RETRY_AFTER_SECONDS,
   type AuthOutcome,
     const parsedBody = await Effect.runPromise(requestBodyFromRequest(request));
     const era = await classifyMcpProtocolEra(request, parsedBody);
     if (era === "modern") {
+      if (env.MCP_2026_07_28_ENABLED === "false") {
+        return mcpModernDisabledResponse();
+      }
       const resource = resourceFromPath(request);
       const props = await runTraced(
         request,

apps/cloud/wrangler.jsonc+3−0

   // secret for both with `wrangler secret put MCP_REQUEST_STATE_KEY`.
   // It must never be placed in `vars` or generated independently per isolate.
   "vars": {
+    // MCP_2026_07_28_ENABLED is intentionally absent: unset enables modern
+    // inbound serving. Set the Worker var to "false" for emergency rollback;
+    // legacy serving remains available.
     "VITE_PUBLIC_SITE_URL": "https://executor.sh",
     "VITE_PUBLIC_POSTHOG_KEY": "phc_nNLrNMALpRsfrEkZovUkfMxYbcJvHnsJHeoSPavprgLL",
     // Browser OTLP spans → same-origin, forwarded to Axiom by the worker

apps/host-cloudflare/src/config.ts+2−0

   readonly EXECUTOR_SECRET_KEY?: string;
   /** HMAC key for MCP 2026-07-28 continuation state (32+ byte secret). */
   readonly MCP_REQUEST_STATE_KEY?: string;
+  /** Emergency rollback for inbound MCP 2026-07-28 traffic only. */
+  readonly MCP_2026_07_28_ENABLED?: string;
   readonly ALLOW_LOCAL_NETWORK?: string;
   readonly VITE_PUBLIC_SITE_URL?: string;
   /**

apps/host-cloudflare/src/mcp/agent-handler.ts+4−0

 import {
   McpAuthProvider,
   jsonRpcErrorBody,
+  mcpModernDisabledResponse,
   defaultMcpResource,
   type AuthOutcome,
   type Principal,
     const parsedBody = await Effect.runPromise(requestBodyFromRequest(request));
     const era = await classifyMcpProtocolEra(request, parsedBody);
     if (era === "modern") {
+      if (env.MCP_2026_07_28_ENABLED === "false") {
+        return mcpModernDisabledResponse();
+      }
       const props = await Effect.runPromise(propsForPrincipal(request, outcome.principal));
       (ctx as ExecutionContext & { props?: McpSessionProps }).props = props;
       const forwarded = withVerifiedIdentityHeaders(

apps/host-cloudflare/wrangler.jsonc+3−0

   // MCP key is a deployment prerequisite shared by Worker and session DOs;
   // never generate it independently per isolate.
   "vars": {
+    // MCP_2026_07_28_ENABLED is intentionally absent: unset enables modern
+    // inbound serving. Set the Worker var to "false" for emergency rollback;
+    // legacy serving remains available.
     "ACCESS_NAME_CLAIM": "name",
     "ACCESS_GROUPS_CLAIM": "groups",
     // Never preserve a production dev-auth override through keep_vars.

apps/host-selfhost/src/app.ts+6−1

   // ---- the in-process MCP serving seams (+ shutdown hook) ----------------
   // Pass the pinned public origin so browser-approval URLs are reachable behind
   // a reverse proxy (not the internal 127.0.0.1 bind from the request URL).
-  const mcp = makeSelfHostMcpSeams(dbHandle, betterAuth, config.webBaseUrl);
+  const mcp = makeSelfHostMcpSeams(
+    dbHandle,
+    betterAuth,
+    config.webBaseUrl,
+    config.mcp20260728Enabled,
+  );
   // CLI device-login discovery (`executor login`). Points the CLI at Better
   // Auth's device endpoints; `requestFormat: "json"` because those endpoints

apps/host-selfhost/src/config.ts+3−0

    * internal network unless an operator opts in.
    */
   readonly allowLocalNetwork: boolean;
+  /** Emergency rollback for inbound MCP 2026-07-28 traffic only. */
+  readonly mcp20260728Enabled: boolean;
   // Better Auth session secret. Always resolved (env, else generated + persisted
   // under the data dir) so a single-container deploy boots with no env; the auth
   // layer still validates an explicitly-set env secret is long enough.
     dbPath: process.env.EXECUTOR_DB_PATH ?? join(dataDir, "data.db"),
     webBaseUrl: resolveWebBaseUrl(port),
     allowLocalNetwork: process.env.EXECUTOR_ALLOW_LOCAL_NETWORK === "true",
+    mcp20260728Enabled: process.env.MCP_2026_07_28_ENABLED !== "false",
     authSecret: resolveAuthSecret(),
     bootstrapAdminEmail: process.env.EXECUTOR_BOOTSTRAP_ADMIN_EMAIL,
     bootstrapAdminPassword: process.env.EXECUTOR_BOOTSTRAP_ADMIN_PASSWORD,

apps/host-selfhost/src/mcp/index.ts+2−1

   dbHandle: SelfHostDbHandle,
   betterAuth: BetterAuthHandle,
   webBaseUrl?: string,
+  modernEnabled = true,
 ): SelfHostMcpSeams => {
   const sessionStore = makeSelfHostMcpSessionStore(dbHandle, webBaseUrl);
   const auth: Layer.Layer<McpAuthProvider, never, IdentityProvider> = selfHostMcpAuth.pipe(
   return {
     auth,
     sessions: selfHostMcpSessions(sessionStore),
-    modern: makeSelfHostMcpModernServerBuilder(dbHandle),
+    modern: makeSelfHostMcpModernServerBuilder(dbHandle, modernEnabled),
     reporter: selfHostMcpReporter,
     approvalHandler: makeApprovalHandler(sessionStore, betterAuth),
     close: sessionStore.close,

apps/host-selfhost/src/mcp/session-store.ts+2−0

 /** Build the stateless MCP server seam over the same self-host stack/config. */
 export const makeSelfHostMcpModernServerBuilder = (
   db: SelfHostDbHandle,
+  enabled = true,
 ): Layer.Layer<McpModernServerBuilder> =>
   Layer.succeed(McpModernServerBuilder)({
+    enabled,
     build: makeMcpBuildServer(
       SelfHostExecutionStackLayer.pipe(Layer.provide(Layer.succeed(SelfHostDb)(db))),
       {

apps/local/src/main.ts+1−0

@@ -119,6 +119,7 @@ export const createServerHandlers = async (token: string): Promise<ServerHandler · 118 unmodified lines
119	localAnalytics.record(`artifact_${action}`, { via: "agent" }),	119	localAnalytics.record(`artifact_${action}`, { via: "agent" }),
120	};	120	};
121	mcp = createMcpRequestHandler({	121	mcp = createMcpRequestHandler({
		122	modernEnabled: process.env.MCP_2026_07_28_ENABLED !== "false",
122	defaultConfig: {	123	defaultConfig: {
123	engine,	124	engine,
124	artifacts: executor.artifacts,	125	artifacts: executor.artifacts,

apps/local/src/mcp-modern.test.ts+52−0

@@ -51,4 +51,56 @@ describe("local modern MCP HTTP", () => { · 50 unmodified lines
51	await mcp.close();	51	await mcp.close();
52	}	52	}
53	});	53	});
		54
		55	it("rejects a pinned modern client with the unsupported-version protocol error", async () => {
		56	const mcp = createMcpRequestHandler({ defaultConfig: { engine }, modernEnabled: false });
		57	const transport = new StreamableHTTPClientTransport(new URL("http://local.test/mcp"), {
		58	fetch: (input, init) =>
		59	mcp.handleRequest(
		60	input instanceof Request ? new Request(input, init) : new Request(input.toString(), init),
		61	),
		62	});
		63	const client = new Client(
		64	{ name: "local-modern-disabled-test", version: "1.0.0" },
		65	{ capabilities: {}, versionNegotiation: { mode: { pin: "2026-07-28" } } },
		66	);
		67
		68	// oxlint-disable-next-line executor/no-try-catch-or-throw -- test boundary: always close a client whose pinned negotiation is expected to fail
		69	try {
		70	await expect(client.connect(transport)).rejects.toThrow(/version negotiation failed/i);
		71	} finally {
		72	await client.close();
		73	await mcp.close();
		74	}
		75	});
		76
		77	it("lets an auto-mode v2 client fall back to legacy when modern inbound is disabled", async () => {
		78	const mcp = createMcpRequestHandler({ defaultConfig: { engine }, modernEnabled: false });
		79	const transport = new StreamableHTTPClientTransport(new URL("http://local.test/mcp"), {
		80	fetch: (input, init) =>
		81	mcp.handleRequest(
		82	input instanceof Request ? new Request(input, init) : new Request(input.toString(), init),
		83	),
		84	});
		85	const client = new Client(
		86	{ name: "local-auto-fallback-test", version: "1.0.0" },
		87	{ capabilities: {}, versionNegotiation: { mode: "auto" } },
		88	);
		89
		90	await client.connect(transport);
		91	// oxlint-disable-next-line executor/no-try-catch-or-throw -- test boundary: always close the fallback client and local handler
		92	try {
		93	expect(client.getProtocolEra()).toBe("legacy");
		94	expect((await client.listTools()).tools.map(({ name }) => name)).toContain("execute");
		95	const result = await client.callTool({
		96	name: "execute",
		97	arguments: { code: "3 + 4" },
		98	});
		99	expect(result.content).toEqual([{ type: "text", text: "ran: 3 + 4" }]);
		100	expect(transport.sessionId).toBeTruthy();
		101	} finally {
		102	await client.close();
		103	await mcp.close();
		104	}
		105	});
54	});	106	});

apps/local/src/mcp.ts+18−0

 import {
   defaultMcpResource,
   jsonRpcErrorBody,
+  mcpModernDisabledResponse,
   mcpResourceKey,
   type McpResource,
 } from "@executor-js/host-mcp";
   appsEnabledForClientCapabilities,
   buildMcpServer,
   clientCapabilitiesFromRequest,
+  mcpRequestStateBindingFromBody,
   requestBodyFromRequest,
   type ExecutorMcpToolConfig,
 } from "@executor-js/host-mcp/tool-server";
 export interface LocalMcpRequestHandlerConfig {
   readonly defaultConfig: ExecutorMcpToolConfig;
+  /** Emergency rollback for inbound MCP 2026-07-28 traffic only. */
+  readonly modernEnabled?: boolean;
   readonly createConfigForResource?: (
     resource: McpResource,
   ) => Promise<LocalMcpServerConfig> | LocalMcpServerConfig;
   const sessionEngines = new Map<string, AnyExecutionEngine>();
   const sessionClosers = new Map<string, () => Promise<void>>();
   const modernHandlers = new Map<string, McpHttpHandler>();
+  const modernRequestBodies = new WeakMap<Request, unknown>();
   const approvals = makeInProcessBrowserApprovalStore();
   const defaultEngine = engineFromConfig(handlerConfig.defaultConfig);
   let requestStateSigningKey: Uint8Array | undefined;
           // oxlint-disable-next-line executor/no-effect-escape-hatch -- boundary: the third-party McpServerFactory Promise contract has no typed failure channel; missing documented request context is an SDK defect
           return Effect.runPromise(Effect.die("Modern MCP request context has no request"));
         }
+        const parsedBody = modernRequestBodies.get(request);
         return Effect.runPromise(
           Effect.gen(function* () {
             const resourceConfig = yield* Effect.promise(() => configForResource(resource));
             const clientCapabilities = yield* clientCapabilitiesFromRequest(request);
+            const requestStateBinding = yield* Effect.promise(() =>
+              mcpRequestStateBindingFromBody({
+                body: parsedBody,
+                principal: "local",
+                resource,
+              }),
+            );
             const server = yield* buildMcpServer({
               ...resourceConfig.config,
               artifactsEnabled: readArtifactsEnabled(request),
               appsEnabled: appsEnabledForClientCapabilities(clientCapabilities),
               requestStateSigningKey: signingKey(),
               requestStatePrincipal: "local",
+              ...(requestStateBinding === null ? {} : { requestStateBinding }),
             });
             if (resourceConfig.close) {
               const closeServer = server.close.bind(server);
       const resource = resourceFromRequest(request);
       if (!resource) return jsonError(404, -32001, "MCP resource not found");
       if (!(await isLegacyRequest(request))) {
+        if (handlerConfig.modernEnabled === false) {
+          return mcpModernDisabledResponse({ cors: false });
+        }
         const parsedBody = await Effect.runPromise(requestBodyFromRequest(request));
+        modernRequestBodies.set(request, parsedBody);
         return modernHandlerFor(resource).fetch(request, { parsedBody });
       }
       const sessionId = request.headers.get("mcp-session-id");

Harden requestState binding, add inbound rollback switch, fix CLI bridge era handling

Keyboard shortcuts

General

Issues and pull requests

Issues, pull requests and Inbox

Repository code