Seller-tool onboarding: Proxy swap route, Holder route in the daemon, holder kit

.gitignore

@@ -16,6 +16,18 @@
 # admitted .scratch/ into the spike tree)
 .scratch/
 *.jsonl
+# Evidence bundles are the exception: the raw MCP request/response captures ARE the evidence,
+# and a summary PASS line is not a substitute for the observation it summarises. Without this
+# exception the *.jsonl rule above silently dropped every transcript the demo recorded
+# (advisor F4). Sanitised by construction — no credential value passes through these surfaces.
+!evidence/**/*.jsonl
+
+# The host-side credential scan (advisor F1) writes a multi-MB tar of the captured job-container
+# filesystem, plus its stderr. The scan SUMMARY (evidence/**/job-*-fs-scan*.txt) and the
+# transcript hashes in manifest.json are the evidence; the raw tar is a large intermediate. Keep
+# it out of the repository.
+evidence/**/*.tar
+evidence/**/*.tar.err
 
 # Environment / secrets
 .env

Cargo.toml

@@ -5,6 +5,7 @@ members = [
     "crates/maxplayer-evals",
     "crates/maxplayer",
     "crates/maxplayer-relay-write-policy",
+    "crates/maxplayer-tool-kit",
 ]
 # maxplayer-desktop pulls egui's native deps (wayland/x11/fontconfig); keep it out of
 # default builds so headless boxes and CI don't inherit them. Build with -p maxplayer-desktop.
@@ -13,6 +14,7 @@ default-members = [
     "crates/maxplayer-evals",
     "crates/maxplayer",
     "crates/maxplayer-relay-write-policy",
+    "crates/maxplayer-tool-kit",
 ]
 resolver = "3"
 

crates/maxplayer-core/src/delivery_orchestrator.rs

@@ -353,6 +353,14 @@ pub struct Phase1Inputs {
     /// gives the agent exactly these (with their values read from the container environment) plus the
     /// runtime baseline ([`AGENT_ENV_BASELINE`]) and the delivery identity, and nothing else.
     pub agent_env_names: Vec<String>,
+    /// The MCP servers the host minted for this launch — the Proxy swap vendor tools, one entry per
+    /// `[sandbox] mcp_tools`, each carrying only a per-job placeholder and the proxy's address
+    /// ([`crate::seller_exec::PreparedLaunch::mcp_servers`]). The orchestrator attaches them to the
+    /// agent's session as they are; inside the container the policy is pass-through and mints
+    /// nothing, so this is the only way they reach the session. Carries NO secret. Optional and
+    /// empty by default, so an inputs file written by a host without this field still parses.
+    #[serde(default)]
+    pub mcp_servers: Vec<crate::driver::McpServer>,
     /// The delivery remote the orchestrator pushes to (the seller's `git_remote`).
     pub relay_url: String,
     /// How the push token is obtained. See [`PushTokenSource`] for who can read it and when.
@@ -549,8 +557,8 @@ fn drive_acp_agent(
     workdir: &Path,
 ) -> Result<AgentOutcome, OrchestratorError> {
     use crate::seller_exec::{
-        AgentRunTimeout, ExecError, SandboxPolicy, run_agent_job_with_env, run_agent_with_retry,
-        unified_job_timeout,
+        AgentRunTimeout, ExecError, JobAttachments, SandboxPolicy, run_agent_job_in_env,
+        run_agent_with_retry, unified_job_timeout,
     };
     let identity = DeliveryAgentIdentity::for_seller(&inputs.seller_pubkey_hex);
     let env = agent_env_allowlist(&inputs.agent_env_names, &identity, |key| {
@@ -567,14 +575,18 @@ fn drive_acp_agent(
         unix_now,
         |_attempt| {
             let timeout = unified_job_timeout(inputs.deadline_unix, unix_now());
-            run_agent_job_with_env(
+            // The host's MCP server list rides along: the pass-through policy here mints none, and
+            // the vendor tools were minted when the host prepared this container.
+            run_agent_job_in_env(
                 &inputs.agent_argv,
                 &policy,
                 &inputs.prompt,
                 workdir,
                 &identity,
                 AgentRunTimeout::JobDeadline(timeout),
                 Some(env.clone()),
+                // Servers only: the HOST mounted this container, so there is nothing to mount here.
+                JobAttachments { mcp_servers: inputs.mcp_servers.clone(), extra_mounts: Vec::new() },
             )
         },
     ));
@@ -1729,6 +1741,7 @@ mod tests {
                 "ANTHROPIC_API_KEY".to_owned(),
                 "ANTHROPIC_BASE_URL".to_owned(),
             ],
+            mcp_servers: Vec::new(),
             relay_url: "ext::sh -c evil".to_owned(),
             push_token,
             handoff_nonce: NONCE.to_owned(),

crates/maxplayer-core/src/driver/acp.rs

@@ -52,10 +52,90 @@ pub struct SessionConfig {
     pub env: Vec<(String, String)>,
 }
 
+/// One MCP server for the session (ACP `session/new` → `mcpServers[]`). Two wire shapes, and the
+/// difference between them is the `type` key:
+///
+/// * [`Self::Stdio`] carries NO `type` key. The adapter the sandbox image bakes (`claude-agent-acp`
+///   0.67.0, `dist/acp-agent.js`, the `mcpServers` loop in `newSession`) treats an entry without
+///   `type` as a stdio server, and an entry with any `type` other than `http`/`sse` as unknown — it
+///   DROPS that entry. So a stdio entry must never say `type: "stdio"`; the absence is the tag.
+/// * [`Self::Http`] carries `type: "http"`, a `url`, and `headers`.
+///
+/// Both shapes are read off that adapter's own mapping code, not guessed from the spec text. The
+/// seller's job path attached no MCP server at all before the Proxy swap route, so the old
+/// `{ name, command: [...] }` shape here was never on a wire; it did not match what any adapter
+/// reads and is gone.
+#[derive(Clone, Debug, Deserialize, PartialEq, Eq, Serialize)]
+#[serde(untagged)]
+pub enum McpServer {
+    Stdio(McpServerStdio),
+    Http(McpServerHttp),
+}
+
+impl McpServer {
+    /// The server name the agent addresses tools under, whichever shape it is.
+    pub fn name(&self) -> &str {
+        match self {
+            Self::Stdio(server) => &server.name,
+            Self::Http(server) => &server.name,
+        }
+    }
+
+    /// Whether any value this entry hands the agent — the command, an argument, an env value, the
+    /// URL, a header value — contains `needle`. The sandbox launch asks this about the proxy's
+    /// docker alias to decide whether the container needs that alias resolved.
+    pub fn references(&self, needle: &str) -> bool {
+        match self {
+            Self::Stdio(server) => {
+                server.command.contains(needle)
+                    || server.args.iter().any(|arg| arg.contains(needle))
+                    || server.env.iter().any(|pair| pair.value.contains(needle))
+            }
+            Self::Http(server) => {
+                server.url.contains(needle) || server.headers.iter().any(|pair| pair.value.contains(needle))
+            }
+        }
+    }
+}
+
+/// A stdio MCP server: the agent spawns `command args…` with `env` added to the child's
+/// environment and speaks JSON-RPC over its stdin/stdout.
+#[derive(Clone, Debug, Deserialize, PartialEq, Eq, Serialize)]
+pub struct McpServerStdio {
+    pub name: String,
+    pub command: String,
+    #[serde(default)]
+    pub args: Vec<String>,
+    #[serde(default)]
+    pub env: Vec<EnvVariable>,
+}
+
+/// A Streamable-HTTP MCP server the agent's own MCP client connects to at `url`, sending `headers`
+/// on every request.
 #[derive(Clone, Debug, Deserialize, PartialEq, Eq, Serialize)]
-pub struct McpServer {
+pub struct McpServerHttp {
+    /// Always `"http"`. A field rather than a serde tag so the stdio variant can carry NO `type`
+    /// key at all (see [`McpServer`]).
+    #[serde(rename = "type")]
+    pub transport: HttpTransport,
     pub name: String,
-    pub command: Vec<String>,
+    pub url: String,
+    #[serde(default)]
+    pub headers: Vec<EnvVariable>,
+}
+
+/// The one value [`McpServerHttp::transport`] takes.
+#[derive(Clone, Copy, Debug, Deserialize, PartialEq, Eq, Serialize)]
+#[serde(rename_all = "lowercase")]
+pub enum HttpTransport {
+    Http,
+}
+
+/// A `{ name, value }` pair, the ACP encoding of one environment variable or one HTTP header.
+#[derive(Clone, Debug, Deserialize, PartialEq, Eq, Serialize)]
+pub struct EnvVariable {
+    pub name: String,
+    pub value: String,
 }
 
 #[derive(Clone, Debug, Deserialize, PartialEq, Eq, Serialize)]
@@ -457,3 +537,80 @@ mod usage_tests {
         assert_eq!(usage.total_tokens(), Some(8));
     }
 }
+
+#[cfg(test)]
+mod mcp_server_wire_tests {
+    use super::*;
+    use serde_json::json;
+
+    // The adapter drops a stdio entry that carries a `type` key (`claude-agent-acp` 0.67.0 reads
+    // `"type" in server` before anything else), so the stdio shape must serialize with none.
+    #[test]
+    fn a_stdio_server_serializes_with_no_type_key() {
+        let server = McpServer::Stdio(McpServerStdio {
+            name: "github".into(),
+            command: "/usr/local/bin/mcp-http-bridge".into(),
+            args: vec!["--proxy-url".into(), "http://host.docker.internal:9100".into()],
+            env: vec![EnvVariable {
+                name: "TOOL_PLACEHOLDER".into(),
+                value: "ph".into(),
+            }],
+        });
+        let wire = serde_json::to_value(&server).expect("encode");
+        assert_eq!(
+            wire,
+            json!({
+                "name": "github",
+                "command": "/usr/local/bin/mcp-http-bridge",
+                "args": ["--proxy-url", "http://host.docker.internal:9100"],
+                "env": [{"name": "TOOL_PLACEHOLDER", "value": "ph"}]
+            })
+        );
+        assert!(wire.get("type").is_none(), "a type key makes the adapter drop the entry");
+        let back: McpServer = serde_json::from_value(wire).expect("decode");
+        assert_eq!(back, server);
+    }
+
+    #[test]
+    fn an_http_server_serializes_with_type_http() {
+        let server = McpServer::Http(McpServerHttp {
+            transport: HttpTransport::Http,
+            name: "github".into(),
+            url: "http://host.docker.internal:9100/mcp/".into(),
+            headers: vec![EnvVariable {
+                name: "Authorization".into(),
+                value: "Bearer ph".into(),
+            }],
+        });
+        let wire = serde_json::to_value(&server).expect("encode");
+        assert_eq!(
+            wire,
+            json!({
+                "type": "http",
+                "name": "github",
+                "url": "http://host.docker.internal:9100/mcp/",
+                "headers": [{"name": "Authorization", "value": "Bearer ph"}]
+            })
+        );
+        let back: McpServer = serde_json::from_value(wire).expect("decode");
+        assert_eq!(back, server);
+    }
+
+    // The session config puts the list under the camelCase key the adapter reads.
+    #[test]
+    fn the_session_config_carries_the_servers_under_mcp_servers() {
+        let cfg = SessionConfig {
+            cwd: "/work".into(),
+            mcp_servers: vec![McpServer::Stdio(McpServerStdio {
+                name: "t".into(),
+                command: "c".into(),
+                args: Vec::new(),
+                env: Vec::new(),
+            })],
+            env: Vec::new(),
+        };
+        let wire = serde_json::to_value(&cfg).expect("encode");
+        assert_eq!(wire["mcpServers"][0]["name"], json!("t"));
+        assert_eq!(wire["mcpServers"][0]["args"], json!([]));
+    }
+}

crates/maxplayer-core/src/driver/mod.rs

@@ -9,9 +9,10 @@ use std::fmt::{self, Display};
 pub use crate::event::RuntimeId;
 
 pub use acp::{
-    Artifact, Caps, ContentBlock, ExtMethod, Initialize, InitializeResult, McpServer,
-    PermissionOutcome, PermissionRequest, PromptTurn, SessionConfig, SessionId, SessionUpdate,
-    StopReason, UpdateStream,
+    Artifact, Caps, ContentBlock, EnvVariable, ExtMethod, HttpTransport, Initialize,
+    InitializeResult, McpServer, McpServerHttp, McpServerStdio, PermissionOutcome,
+    PermissionRequest, PromptTurn, SessionConfig, SessionId, SessionUpdate, StopReason,
+    UpdateStream,
 };
 #[cfg(feature = "acp")]
 pub use acp_driver::{AcpDriver, AgentCommand};