Codex/expose advanced apis for UI manipulation

.dockerignore

@@ -0,0 +1,18 @@
+__pycache__/
+*.pyc
+*.pyo
+*.pyd
+*.egg-info/
+build/
+dist/
+.coverage
+htmlcov/
+venv/
+.venv/
+.git/
+.github/
+tests/
+docs/
+examples/
+*.md
+!README.md

.github/CODEOWNERS

@@ -0,0 +1,12 @@
+# CODEOWNERS for mcp-agent
+# Default owners
+* @yourorg/platform @yourorg/agents-core
+
+# Specific paths
+/.github/ @yourorg/devops
+/Dockerfile @yourorg/devops
+/.dockerignore @yourorg/devops
+/schemas/ @yourorg/platform
+/src/ @yourorg/agents-core
+/tests/ @yourorg/agents-core
+/scripts/ @yourorg/devops

.github/workflows/build.yml

@@ -0,0 +1,85 @@
+name: Build and Publish (Hardened)
+on:
+  workflow_call:
+
+jobs:
+  build:
+    runs-on: [self-hosted, linux]
+    permissions:
+      contents: read
+      packages: write
+    steps:
+      - uses: actions/checkout@v4
+      - uses: hadolint/[email protected]
+        with:
+          dockerfile: Dockerfile
+          failure-threshold: warning
+          config: .hadolint.yaml
+      - uses: docker/setup-qemu-action@v3
+      - uses: docker/setup-buildx-action@v3
+      - uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.repository_owner }}
+          password: ${{ secrets.GHCR_TOKEN }}
+      - id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: ghcr.io/${{ github.repository_owner }}/mcp-agent
+          tags: |
+            type=raw,value=sha-${{ github.sha }}
+            type=ref,event=tag
+          labels: |
+            org.opencontainers.image.revision=${{ github.sha }}
+            org.opencontainers.image.source=${{ github.server_url }}/${{ github.repository }}
+      - id: build
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          push: ${{ github.event_name == 'push' && startsWith(github.ref, 'refs/tags/agent-v') }}
+          platforms: linux/amd64
+          labels: ${{ steps.meta.outputs.labels }}
+          build-args: |
+            BUILD_DATE=${{ steps.meta.outputs.created }}
+            VCS_REF=${{ github.sha }}
+            VERSION=${{ github.ref_name }}
+          outputs: type=image,name=target,dest=/tmp/image.tar
+      - if: ${{ github.event_name == 'push' && startsWith(github.ref, 'refs/tags/agent-v') }}
+        run: echo "${{ steps.build.outputs.digest }}" | tee digest.txt
+      - if: ${{ github.event_name == 'push' && startsWith(github.ref, 'refs/tags/agent-v') }}
+        uses: actions/upload-artifact@v4
+        with:
+          name: image-digest
+          path: digest.txt
+      - uses: anchore/sbom-action@v0
+        with:
+          image: docker-archive:/tmp/image.tar
+          format: spdx-json
+          output-file: sbom.spdx.json
+      - uses: actions/upload-artifact@v4
+        with:
+          name: sbom-spdx
+          path: sbom.spdx.json
+
+  runtime-test:
+    runs-on: [self-hosted, linux]
+    needs: build
+    steps:
+      - uses: actions/checkout@v4
+      - run: docker build -t local/mcp-agent:test .
+      - name: Verify non-root
+        run: |
+          uid=$(docker run --rm local/mcp-agent:test id -u)
+          test "$uid" != "0"
+      - name: Verify health
+        run: |
+          cid=$(docker run -d -p 3002:3002 local/mcp-agent:test)
+          for i in $(seq 1 30); do
+            if curl -fsS http://127.0.0.1:3002/health >/dev/null; then
+              docker rm -f "$cid" >/dev/null; exit 0
+            fi
+            sleep 1
+          done
+          docker logs "$cid" || true
+          docker rm -f "$cid" || true
+          exit 1

.github/workflows/checks.yml

@@ -1,66 +1,51 @@
 name: Linting, formatting and other checks on codebase
-
 on:
   workflow_call:
-
 jobs:
   format:
-    runs-on: ubuntu-latest
+    runs-on: [self-hosted, Linux, X64]
     steps:
       - uses: actions/checkout@v4
-
       - name: Install uv
         uses: astral-sh/setup-uv@v3
         with:
-          enable-cache: true
-
+          enable-cache: false
       - name: "Set up Python"
         uses: actions/setup-python@v5
         with:
           python-version-file: ".python-version"
-
       - name: Install the project
-        run: uv sync --frozen --all-extras --dev
-
+        run: uv sync --all-extras --dev
       - name: Run ruff format check
         run: uv run scripts/format.py
-
   lint:
-    runs-on: ubuntu-latest
+    runs-on: [self-hosted, Linux, X64]
     steps:
       - uses: actions/checkout@v4
-
       - name: Install uv
         uses: astral-sh/setup-uv@v3
         with:
-          enable-cache: true
-
+          enable-cache: false
       - name: "Set up Python"
         uses: actions/setup-python@v5
         with:
           python-version-file: ".python-version"
-
       - name: Install the project
-        run: uv sync --frozen --all-extras --dev
-
+        run: uv sync --all-extras --dev
       - name: Run pyright
         run: uv run scripts/lint.py
-
   test:
-    runs-on: ubuntu-latest
+    runs-on: [self-hosted, Linux, X64]
     steps:
       - uses: actions/checkout@v4
-
       - name: Install uv
         uses: astral-sh/setup-uv@v3
         with:
-          enable-cache: true
-
+          enable-cache: false
       - name: "Set up Python"
         uses: actions/setup-python@v5
         with:
           python-version-file: ".python-version"
-
       - name: Install dependencies
         run: make sync
       - name: Run tests with coverage

.github/workflows/main-checks.yml

@@ -1,13 +1,6 @@
 name: Main Checks
-
 on:
-  push:
-    branches:
-      - main
-      - "v*.*.*"
-    tags:
-      - "v*.*.*"
-
+  workflow_dispatch:
 jobs:
   checks:
     uses: ./.github/workflows/checks.yml

.github/workflows/public-api-contract.yml

@@ -0,0 +1,18 @@
+name: Public API Contract
+on:
+  workflow_call:
+  workflow_dispatch:
+jobs:
+  contract:
+    runs-on: [self-hosted, linux]
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: '3.11'
+      - name: Install deps
+        run: |
+          python -m pip install --upgrade pip
+          pip install starlette pytest httpx PyJWT
+      - name: Run tests
+        run: pytest -q tests/public_api

.github/workflows/push-prod-image.yml

@@ -0,0 +1,62 @@
+name: Push Production Docker Image
+
+on:
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: "Image tag to publish (for example: v1.2.3 or latest)"
+        required: true
+        default: latest
+      image_name:
+        description: "Override the image name (defaults to mcp-agent)"
+        required: false
+        default: mcp-agent
+      runner_labels:
+        description: >-
+          JSON array of runner labels (for example: ["ubuntu-latest"] or
+          ["self-hosted", "linux", "x64"])
+        required: false
+        default: '["ubuntu-latest"]'
+
+env:
+  REGISTRY: ghcr.io
+
+jobs:
+  push:
+    name: Build and push image
+    runs-on: ${{ fromJSON(inputs.runner_labels) }}
+    permissions:
+      contents: read
+      packages: write
+    env:
+      IMAGE_NAME: ${{ github.repository_owner }}/${{ inputs.image_name }}
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Log in to GHCR
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.repository_owner }}
+          password: ${{ secrets.GHCR_TOKEN }}
+
+      - name: Extract Docker metadata
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+          tags: |
+            type=raw,value=${{ inputs.tag }}
+            type=sha
+
+      - name: Build and push image
+        uses: docker/build-push-action@v5
+        with:
+          context: .
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}

.github/workflows/release-drafter.yml

@@ -1,32 +1,16 @@
 name: Update Release Draft
-
 on:
-  push:
-    branches:
-      - main
-
-  # pull_request event is required only for autolabeler
-  pull_request:
-    # Only following types are handled by the action, but one can default to all as well
-    types: [opened, reopened, synchronize]
-
-  # pull_request_target event is required for autolabeler to support PRs from forks
-  pull_request_target:
-    types: [opened, reopened, synchronize]
-
-  workflow_dispatch: # Enables manual runs
-
+  workflow_dispatch:
 permissions:
   contents: read
-
 jobs:
   update_release_draft:
     permissions:
       # write permission is required to create a github release
       contents: write
       # write permission is required for autolabeler
       pull-requests: write
-    runs-on: ubuntu-latest
+    runs-on: [self-hosted, Linux, X64]
     steps:
       - uses: actions/checkout@v3
       - uses: release-drafter/release-drafter@v6

.github/workflows/tool-clients.yml

@@ -0,0 +1,19 @@
+name: Tool Clients
+on:
+  workflow_call:
+  workflow_dispatch:
+jobs:
+  tests:
+    runs-on: [self-hosted, linux]
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: '3.11'
+      - name: Install deps
+        run: |
+          python -m pip install --upgrade pip
+          pip install pytest httpx jsonschema prometheus_client
+      - name: Run tests
+        run: |
+          pytest -q tests/tool_clients

.github/workflows/tools-registry.yml

@@ -0,0 +1,19 @@
+name: Tools Registry
+on:
+  workflow_call:
+  workflow_dispatch:
+jobs:
+  tests:
+    runs-on: [self-hosted, linux]
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: '3.11'
+      - name: Install deps
+        run: |
+          python -m pip install --upgrade pip
+          pip install pytest httpx pyyaml
+      - name: Run registry tests
+        run: |
+          pytest -q tests/registry