4 Commits

Include renames

Author	SHA1	Message	Date
Marco Sadjadi	147ba69968	fix(runner): alias params/input to args so tool implementations don't ReferenceError ... Auth chain finally landed but tool calls crashed in the wetter server with "Error: params is not defined". The MCP SDK passes the validated tool args as a single parameter; our template names that parameter `args` but the model frequently writes `params.location` / `input.x` because that's how OpenAPI and JSON-RPC reference docs read. Two-sided fix: - render.ts wraps every implementation with `const params = args; const input = args;` inside the try block. Whichever alias the model picked, the variable resolves to the same validated object. - SYSTEM_PROMPT now states the variable name EXPLICITLY ("variable named EXACTLY `args`, e.g. args.location") so new generations stop drifting on that detail. Existing wetter runner needs a rebuild to pick up the alias shim.	2026-05-28 21:39:11 +02:00
Marco Sadjadi	4d136c4fb2	fix(mcp): RFC 9728 protected-resource metadata path + audience binding ... Codex/RFC review showed that Claude Desktop addresses the MCP resource as <PUBLIC_URL>/mcp (the streamable-HTTP endpoint) rather than the base URL. Per RFC 9728 the protected-resource metadata then lives at .well-known/oauth-protected-resource inserted between host and path: https://mcp.buildmymcpserver.com/.well-known/oauth-protected-resource/<slug>/mcp Runner template now: - publishes `resource: <PUBLIC_URL>/mcp` - sets WWW-Authenticate to the RFC 9728 well-known URL - serves /.well-known/oauth-protected-resource[/*] so the metadata answers at both the legacy and RFC paths during transition - accepts both audiences (<PUBLIC_URL>/mcp + <PUBLIC_URL>) during rollout so already-issued tokens keep working API: - resolveServerByResource() tries port first, then path segment (production path-routing), with a guard against treating "mcp" as a tenant slug - AS metadata advertises resource_parameter_supported: true nginx (scripts/setup-runner-tls.sh + scripts/bmm-mcp-runners.nginx): - new location matches /.well-known/oauth-protected-resource/<slug>/... and proxies to the slug's runner with the slug stripped, so the runner sees the local well-known path Docs (oauth + api-reference) updated to the RFC paths.	2026-05-28 20:54:27 +02:00
Marco Sadjadi	ab67203921	fix: live-run wiring (SDK 1.29, zod 3.25, OAUTH_ISSUER split, alt host ports, web on 3001, log level cast, pino transport) ... - Bump @modelcontextprotocol/sdk from 1.0.4 to 1.29.0 in runner-template (1.0.4 has no McpServer or StreamableHTTPServerTransport — file not found at runtime). - Bump zod to 3.25.76 across workspace to satisfy modern SDK peer dep. - Split OAUTH_ISSUER (canonical, host-reachable) from CONTROL_PLANE_URL (container-reachable for JWKS). Runner verifies iss against OAUTH_ISSUER; fetches JWKS from CONTROL_PLANE_URL. Both API and runner now agree on http://localhost:4000/oauth as the issuer in dev. - Move postgres host port 5432 to 5440, redis 6379 to 6390 to avoid collisions with native installs on the dev machine. - Move web from 3000 to 3001 (3000 occupied by Gitea on dev machine). - Drop pino-pretty transport from API to avoid runtime require of an unbundled dep. - Cast build_logs.level (varchar) to BuildEvent's literal union in WS replay path. - Remove unused reqBase helper in oauth.ts.	2026-05-19 00:57:23 +02:00
Marco Sadjadi	cc24dd4a63	feat(generator): BullMQ worker (Claude API + spec render + docker build + local deploy)	2026-05-19 00:26:53 +02:00