Repository navigation
Conversation
Contributor
|
Important Draft PR not reviewedDraft PRs are not automatically reviewed by default.
To automatically review draft PRs, update your CodeRabbit configuration: reviews:
auto_review:
drafts: true
Comment |
0chroma
force-pushed
the
mcp-server
branch
2 times, most recently
from
October 9, 2026 00:49
6166ed3 to
7f0b725
Compare
0chroma
changed the base branch from
refactor/activation-to-minimal-client
to
refactor/dash-share-cli-helpers
October 9, 2026 00:50
0chroma
force-pushed
the
mcp-server
branch
5 times, most recently
from
October 10, 2026 05:30
f93f8ae to
6b11754
Compare
0chroma
force-pushed
the
mcp-server
branch
3 times, most recently
from
October 14, 2026 17:54
50c2b13 to
e1d2d1b
Compare
0chroma
force-pushed
the
mcp-server
branch
2 times, most recently
from
October 15, 2026 15:11
d3117a1 to
fcddf99
Compare
0chroma
force-pushed
the
mcp-server
branch
3 times, most recently
from
October 20, 2026 18:12
5b9293d to
89aa28e
Compare
Add `min mcp`, a Model Context Protocol server on stdio that exposes the session plane as a shell-execution surface for an agent harness. Tools create isolated sandboxes (uploading a working directory), exec commands, read and write files over SFTP, list and destroy sessions, and list loadouts; the initialize instructions teach the isolation, upload, /workbench layout, default-session, and lifetime contract. Supporting client helpers: `Client::exec_collect` (drain an exec channel into stdout/stderr/exit code with an optional timeout), `Client::open_sftp`, and a structured loadout listing shared with `min loadout list`. The activation core gains `activate_headless`, whose concrete gate keeps the future `Send` for rmcp handlers; the CLI split exposes a headless create that shares every client-side resolution step. stdout is the JSON-RPC channel, so `Command::Mcp` joins the tracing stdout-contract set and the uploads are quiet.
SftpSession::write opens with OpenFlags::WRITE alone, so write_file failed with ENOENT on any file that did not already exist and never truncated an existing one. Open with create (CREATE | TRUNCATE | WRITE), write, and close the handle instead. The SFTP server also resolves a bare relative path against the sandbox root, not the session home as the tool descriptions claimed. Anchor relative paths at /workbench, the uploaded tree and the exec working directory, and correct the descriptions and the initialize instructions. Extend the mcp integration test with a write/read round-trip so the regression is covered.
… them all The headless gate refused every Pending configure response, so min mcp could not create a session the CLI creates without a prompt: the daemon routes project config back for gating even when the user policy approves every item, and min session activate --no-prompt resolves that with NoPromptHook and only aborts when an item genuinely needs a prompt. Give the server the same lane: compute the verdict under NoPromptHook and the user policy, submit it when nothing is left unapproved, and refuse with the user_policy.toml snippet only when something is. Drop the minimal-client RefusePending gate; the MCP path supplies this concrete, Send gate instead.
create_session gains a `sync` argument: `tarball` force-uploads the working directory, `none` starts the sandbox with an empty workspace, and omitting it keeps the activation default, which uploads only a VCS root or a directory carrying a minimal.toml. The result now reports `uploaded` so the model knows whether /workbench is populated. Thread the resolved upload decision through the shared activation core (`PreparedActivation` and `ActivatedSession` gain `uploaded`), and update the tool and section descriptions to state the upload rules.
`min mcp` only spoke stdio. Enable rmcp's streamable-HTTP server transport and serve it under `/mcp` with axum, selected by a new `--transport` flag; `--bind` (default 127.0.0.1:3000) chooses the address. Loopback is the default because the server runs unrestricted commands in the sandboxes it creates. A non-loopback bind is an explicit exposure: rmcp's Host-header allowlist is disabled for it and a stderr warning says it carries no authentication. The bound address goes to stderr (stdout stays empty in HTTP mode), so a `--bind ...:0` caller can find the port. The integration test drives initialize, notifications/initialized, and tools/list over HTTP.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
min mcpserves the Model Context Protocol over stdio, exposing the session plane as a sandboxed shell-execution surface for an agent harness. Tools create isolated sandboxes (uploading a working directory), run commands, read and write files, and manage sessions.Stacked on the activation extraction in the PR below.
Tools
list_loadouts,create_session,destroy_session,list_sessionsexec, with optionalstdinand a timeout, returning stdout, stderr, and exit coderead_fileandwrite_fileover SFTP, resolving at the session homeThe first
execor file call with nosession_idlazily creates a default session from--workdir. The initializeinstructionsfield states the contract. Each session has its own filesystem and processes. Creating one uploads a directory that becomes/workbench. Sessions persist until destroyed.Approach
Client::exec_collectdrains an exec channel with an optional timeout, andClient::open_sftpopens the SFTP subsystem.loadout_listing, shared bymin loadout listand thelist_loadoutstool.Sendgate, which the rmcp tool handlers require.stdout is the JSON-RPC channel, so
Command::Mcproutes tracing to stderr and the uploads draw no progress bars.Risks
The server creates sandboxes and runs commands on the host daemon. Session creation uses the same gate as the CLI, so a composition needing interactive approval fails with the
user_policy.tomlhint. New dependency:rmcp, vetted by cargo-deny.Testing
cargo test -p minimal --test mcpdrives the compiled binary over stdio against a test daemon: initialize, tool listing, create, list, and destroy.execand SFTP need a real package registry to spawn, so the integration test covers creation and management. Unit tests cover argv quoting, the instructions text, and parameter parsing.