The gateway URL's trailing slashes were stripped with /\/+$/, which CodeQL
flags as polynomial on a URL of many slashes; a plain loop replaces it.
CI now pins setup-bun to a commit and installs with --ignore-scripts, and
run-all.sh uses [[ ]].
Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_012AuVk4nEvBXaTjs4G6wdW4
- make accept / bun run accept now run scripts/accept/run-all.sh, which
runs wave-1..N in numeric order and stops at the first failure (the old
'bash scripts/accept/wave-*.sh' only ran wave-1.sh).
- wave-3 accept checks the new config shape, the bin, and spawns the
broker to verify the stdio handshake.
- CI: bun 1.4.2, bun install, make check, make accept on PRs and main.
- README documents the gateway contract (targets, routes, naming), broker
env vars, library use of the prefix assembler, and the spec deviation.
Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_012AuVk4nEvBXaTjs4G6wdW4
- meta-router-mcp.ts now serves newline-delimited JSON-RPC 2.0 over stdio
when run as main (initialize with protocol negotiation, ping, tools/list
with only the 3 meta-tools, tools/call, standard error codes).
- New Streamable HTTP MCP client (JSON and SSE replies, Mcp-Session-Id,
one initialize per backend, re-init on expired session) wired for every
backend through agentgateway (HERETEK_GATEWAY_URL, /mcp/<target> routes
or one multiplexed /mcp route). Role check and circuit breaker stay in
front of every call.
- Catalog discovery: each backend's tools/list replaces its offline seed
entries in the BM25 catalog (startup, TTL refresh, refreshCatalog()).
- Catalog names follow agentgateway's multiplex convention <target>_<tool>.
- Tests: spawned stdio server, fake MCP HTTP gateway (JSON + SSE, sessions,
breaker), discovery replace/keep semantics.
Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_012AuVk4nEvBXaTjs4G6wdW4
Claude