[Feat] Let agents call HTTP integrations without handling credentials

[roomote-roomote]

​Opened on behalf of @mrubens. Follow up by mentioning @roomote-roomote, in the web UI, or in Slack.

What changed

Add opt-in HTTP integrations for Fast sessions and sandbox agents through the same Roomote API and actor-access rules. Agents choose a configured integration, method, path, and request body. The API retrieves an environment-referenced credential server-side, attaches authentication, and forwards HTTPS without exposing credentials in agent configuration or tool listings.

• Configure named HTTPS origins, method/path-prefix rules, and optional user allowlists in a read-only API manifest. Invalid enabled configuration fails closed.
• Apply public-address/DNS-pinned SSRF protection, reject redirects and arbitrary caller headers, and bound request size, response size, duration, and concurrency. Reject literal credential reflections and keep transport errors generic.
• Share discovery, authentication, guidance, and refresh behavior across Fast and sandbox agents. Fast retains durable integration-call auditing.
• Preserve existing custom MCP names. If an environment already defines _roomote_http_integrations, its server wins and the generated broker is omitted with a warning. Rename the operator server to receive both; Fast is unaffected.
• Identify the generated broker with worker-internal provenance carried through harness parsing and normalization, not operator-controlled names, URL suffixes, or supplied markers. Do not serialize that internal marker into the final OpenCode configuration.
• Separately repair a pre-existing shared MCP client issue: check MCP isError before payload extraction so denied tool calls enter Fast's failed audit path. Preserve successful payload behavior and avoid copying upstream error contents into the new error.
• Document operator setup, access policy, restart/reload requirements, and limitations.

Enable with R_HTTP_INTEGRATIONS_ENABLED=true; supply R_HTTP_INTEGRATIONS_CONFIG_PATH and credential variables only to the API. Omitting allowedUserIds shares an integration with active human members. Actorless service runs are rejected. Manifest grants are startup snapshots: removal requires API reload/restart, not immediate revocation. This is not Session-scoped authorization.

Existing OAuth/inference flows and normal networking remain unchanged. There is no iron-proxy dependency, global proxy setting, provider-specific egress change, or hard network isolation.

How it was tested

Final tested head: e8c623e309c78928fc47929a97b9ca8efea8f86b.

• 192 worker tests passed, including actual resolver-to-harness configuration flow, matching-suffix and exact-URL operator collisions, marker spoofing, remote/stdio/header preservation, real broker mounting, and marker-free serialization.
• 355 shared MCP/Fast tests passed, covering allowed results, MCP tool errors, protocol/transport failures, cancellation, and success/failure audit dispatch. The new error guard reproduces five regression failures when removed.
• pnpm lint:fast, pnpm format:check, pnpm check-types:fast (27 packages), pnpm knip, and normal commit/pre-push hooks passed. Worker and cloud-agents full package type checks passed. The worker release archive was rebuilt with this exact embedded commit.
• Direct live local API smoke passed 20 checks with real PostgreSQL, authentication, route policy, broker, DNS, TLS, upstream, and persisted audits. Allowed GETs recorded succeeded; denied POST/nonallowlisted/removed-member calls recorded failed. Manifest grant removal was effective only after API reload. Inspected result/config-metadata/audit surfaces contained no literal fixture credential or token. The public Basic Auth demonstration endpoint is not evidence for a private provider credential.

Full product readiness remains unverified. Two model-driven Fast attempts stopped at an acknowledgement/subagent-context guard before the broker call. One fresh task was accepted by the local API but failed with docker_daemon_unreachable before worker execution. Thus successful model-driven Fast and fresh-sandbox authenticated requests are not claimed. No production changes or deployments were made.

The initial implementation and earlier compatibility fixes also passed their documented API, SDK, types, worker, Fast, and docs suites. The local TLS unit test explicitly allows its loopback fixture; the separate live smoke does not mock DNS/TLS or upstream authentication.

Response reflection detection is literal, not general DLP. Operators must exclude credential-echo/debug endpoints and APIs that expand authority through query/body parameters. Initial support is one environment-backed auth header and bounded UTF-8 text/JSON, not OAuth refresh, private-network targets, streaming, or arbitrary headers.

Checklist

• The PR title follows the repo convention: [Fix], [Feat], [Improve], [Refactor], [Docs], or [Chore] followed by a user-facing description
• This PR is small and scoped to one change
• pnpm lint and pnpm check-types pass locally (formatting/full lint and the repository's fast type-check gate passed; exact commands are listed above)
• I added tests or included a clear manual validation note above
• I removed secrets, tokens, private keys, and customer data from code, logs, and screenshots
• If this change should appear in the changelog, I ran pnpm changeset

[roomote-community]

No new code issues found. See task

• packages/sdk/src/server/routers/mcp-connections.ts:144: Existing custom MCPs named http-integrations are silently removed or replaced when the new reserved broker name is enabled.
• packages/types/src/custom-mcp-servers.ts:40: Existing environment-level MCPs named _roomote_http_integrations are silently skipped when the broker is enabled.
• apps/worker/src/run-task/agent-home.ts:700: An operator MCP sharing the broker's path suffix is misclassified as the HTTP integrations broker.

_{Reviewed b732e37}

[roomote-roomote]

Fixed the reported custom MCP name collision in d1a7c7f7 and resolved its review thread.

The built-in broker now uses a reserved ID outside the valid custom-server namespace. Existing custom MCPs named http-integrations retain their configuration and routing with the feature disabled or enabled. The API route, tools, and environment settings are unchanged.

227 focused tests passed, along with affected-package type checks, docs checks, and all pre-push gates. PR metadata is refreshed. The automatic Roomote re-review and full CI test job are still in progress; their success is not yet claimed. No live provider or production changes were made.