v0.9.0 — add create_deploy + 4 deploy management tools#4
Merged
Conversation
Agents previously had to read docs to learn the POST /deploy/new multipart endpoint. This adds a first-class tool that takes a base64-encoded gzip tarball and returns a public URL, plus list/get/ redeploy/delete tools so the full deploy lifecycle is reachable from an MCP client. resource_bindings is documented as "agent passes resource tokens; api resolves server-side" — the client never pre-resolves tokens to connection URLs, which would leak secrets into tool params. Tools: 11 → 16. Adds requestMultipart() helper to client.ts.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
create_deploypluslist_deployments,get_deployment,redeploy,delete_deploymentso the full container-deploy lifecycle is reachable from any MCP client (Claude Code, Cursor, Windsurf). Tools: 11 → 16.requestMultipart<T>()tosrc/client.ts. Decodes the agent's base64 gzip tarball to aBuffer, wraps it as aBloband attaches as thetarballform file alongsidename,port,env, and JSON-stringifiedenv_vars. Bearer auth header is set;Content-Typeis left tofetch()so it can fill in the multipart boundary.resource_bindingsis documented as "agent passes resource tokens; api resolves server-side." The client mergesresource_bindingsintoenv_varsas raw token strings and never round-tripsGET /credentialsitself — pre-resolving would leak connection URLs into the tool params, which the agent host may log.package.jsonandserver.jsonto 0.9.0. README updated with a deploy section (tarball construction snippets, resource-binding semantics, polling guidance).test.shgains two new assertions: the full 16-tool list, an explicit check that the 5 new deploy tools are registered, and an auth-required smoke test forcreate_deploywithoutINSTANODE_TOKEN.Test plan
npm run buildexits 0 (TypeScript compiles cleanly)npm testexits 0 — 8 PASS, 0 FAILtools/listreturns all 16 tools, no stragglers from the dead-tools blocklistcreate_deploywithoutINSTANODE_TOKENsurfaces the auth-required text instead of network-callingINSTANODE_TOKENagainst a deploy-enabled environment)🤖 Generated with Claude Code