Render integration capability descriptions in the execute inventory

.github/workflows/ci.yml

@@ -2,6 +2,8 @@ name: CI
 
 on:
   pull_request:
+    branches:
+      - main
   push:
     branches:
       - main

.github/workflows/inventory-ci.yml

@@ -0,0 +1,140 @@
+name: Inventory CI
+
+on:
+  pull_request:
+    branches:
+      - inventory-descriptions
+  push:
+    branches:
+      - inventory-descriptions
+
+permissions:
+  contents: read
+
+concurrency:
+  group: inventory-ci-${{ github.ref }}
+  cancel-in-progress: true
+
+env:
+  DO_NOT_TRACK: "1"
+  EXECUTOR_DISABLE_ANALYTICS: "1"
+  EXECUTOR_DISABLE_INTEGRATIONS_FETCH: "1"
+
+jobs:
+  checks:
+    name: Inventory ${{ matrix.name }}
+    runs-on: ubuntu-24.04
+    timeout-minutes: 15
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - name: Format
+            command: bun run format:check
+          - name: Lint
+            command: bun run lint
+          - name: Typecheck
+            command: bunx turbo run typecheck --filter='./packages/core/*' --filter='./packages/hosts/*' --filter=@executor-js/host-selfhost --concurrency=2
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 24
+      - uses: oven-sh/setup-bun@v2
+        with:
+          bun-version-file: package.json
+      - uses: actions/cache@v4
+        with:
+          path: ~/.bun/install/cache
+          key: ${{ runner.os }}-${{ runner.arch }}-inventory-bun-${{ hashFiles('bun.lock', 'package.json', 'patches/**') }}
+          restore-keys: |
+            ${{ runner.os }}-${{ runner.arch }}-inventory-bun-
+      - run: bun install --frozen-lockfile
+      - run: bun run check:patches
+      - run: ${{ matrix.command }}
+
+  tests:
+    name: Inventory ${{ matrix.name }}
+    runs-on: ubuntu-24.04
+    timeout-minutes: 15
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - name: Core and hosts tests
+            browsers: true
+            # Forward worker limits, the browser path and telemetry opt-outs.
+            command: bunx turbo run test --filter='./packages/core/*' --filter='./packages/hosts/*' --concurrency=1 --env-mode=loose
+          - name: Selfhost tests
+            browsers: false
+            command: bun run --cwd apps/host-selfhost test
+    env:
+      VITEST_MAX_WORKERS: "2"
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 24
+      - uses: oven-sh/setup-bun@v2
+        with:
+          bun-version-file: package.json
+      - uses: actions/cache@v4
+        with:
+          path: ~/.bun/install/cache
+          key: ${{ runner.os }}-${{ runner.arch }}-inventory-bun-${{ hashFiles('bun.lock', 'package.json', 'patches/**') }}
+          restore-keys: |
+            ${{ runner.os }}-${{ runner.arch }}-inventory-bun-
+      - run: bun install --frozen-lockfile
+      - run: bun run check:patches
+      - uses: actions/cache@v4
+        if: matrix.browsers
+        with:
+          path: ~/.cache/ms-playwright
+          key: ${{ runner.os }}-${{ runner.arch }}-inventory-playwright-${{ hashFiles('bun.lock') }}
+      # The MCP Apps shell suite drives a real Chromium. Use the workspace's
+      # pinned Playwright and install its Linux libraries on the hosted runner.
+      - name: Install Chromium
+        if: matrix.browsers
+        working-directory: e2e
+        run: |
+          bunx playwright install --with-deps chromium
+          echo "PLAYWRIGHT_CHROMIUM_EXECUTABLE_PATH=$(bun -e 'import { chromium } from "playwright"; console.log(chromium.executablePath())')" >> "$GITHUB_ENV"
+      - run: ${{ matrix.command }}
+
+  passthrough:
+    name: Inventory Passthrough e2e
+    runs-on: ubuntu-24.04
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 24
+      - uses: oven-sh/setup-bun@v2
+        with:
+          bun-version-file: package.json
+      - uses: actions/cache@v4
+        with:
+          path: ~/.bun/install/cache
+          key: ${{ runner.os }}-${{ runner.arch }}-inventory-bun-${{ hashFiles('bun.lock', 'package.json', 'patches/**') }}
+          restore-keys: |
+            ${{ runner.os }}-${{ runner.arch }}-inventory-bun-
+      - run: bun install --frozen-lockfile
+      - run: bun run check:patches
+      - uses: actions/cache@v4
+        with:
+          path: ~/.cache/ms-playwright
+          key: ${{ runner.os }}-${{ runner.arch }}-inventory-playwright-${{ hashFiles('bun.lock') }}
+      - name: Install Chromium
+        working-directory: e2e
+        run: bunx playwright install --with-deps chromium
+      - name: Run passthrough journey with credential assertion
+        working-directory: e2e
+        run: bunx vitest run --project selfhost scenarios/mcp-passthrough.test.ts
+      - name: Upload passthrough evidence
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: inventory-passthrough-e2e
+          path: e2e/runs/selfhost/
+          retention-days: 7

.github/workflows/pkg-pr-new.yml

@@ -2,6 +2,8 @@ name: Publish (pkg.pr.new)
 
 on:
   pull_request:
+    branches:
+      - main
 
 permissions:
   contents: read

.github/workflows/preview.yml

@@ -13,6 +13,8 @@ name: Preview
 
 on:
   pull_request:
+    branches:
+      - main
     types: [opened, reopened, synchronize, closed]
 
 permissions:

apps/host-selfhost/scripts/bench-mcp-session.ts

@@ -0,0 +1,167 @@
+import { mkdtempSync, readFileSync, writeFileSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { resolve, join } from "node:path";
+import { createHash } from "node:crypto";
+import { Effect, Layer, Tracer } from "effect";
+import { Client } from "@modelcontextprotocol/sdk/client/index.js";
+import { InMemoryTransport } from "@modelcontextprotocol/sdk/inMemory.js";
+import { AuthTemplateSlug, ConnectionName, IntegrationSlug } from "@executor-js/sdk";
+import { makeMcpBuildServer, makeScopedExecutor, PluginsProvider } from "@executor-js/api/server";
+import { createSelfHostDb, SelfHostDb } from "../src/db/self-host-db";
+import { SelfHostExecutionStackLayer, SelfHostScopedExecutorSeams } from "../src/execution";
+import type { SelfHostPlugins } from "../src/plugins";
+import executorConfig from "../executor.config";
+
+const dataDir = mkdtempSync(join(tmpdir(), "executor-session-bench-"));
+process.env.EXECUTOR_DATA_DIR = dataDir;
+const db = await createSelfHostDb({ path: join(dataDir, "data.db") });
+const dbLayer = Layer.succeed(SelfHostDb)(db);
+const samples = Number(process.env.BENCH_SAMPLES ?? 25);
+const phases: Record<string, number[]> = {};
+const record = (name: string, ms: number) => (phases[name] ??= []).push(ms);
+const tracer = Tracer.make({
+  span(options) {
+    const span = new Tracer.NativeSpan(options);
+    const end = span.end.bind(span);
+    span.end = (time, exit) => {
+      record(options.name, Number(time - options.startTime) / 1e6);
+      end(time, exit);
+    };
+    return span;
+  },
+});
+const pluginsLayer = Layer.succeed(PluginsProvider)({
+  plugins(context) {
+    const start = performance.now();
+    const plugins = executorConfig.plugins({
+      activeToolkitSlug:
+        context?.mcpResource?.kind === "toolkit" ? context.mcpResource.slug : undefined,
+    });
+    record("plugins.factory", performance.now() - start);
+    return plugins;
+  },
+});
+const stack = SelfHostExecutionStackLayer.pipe(Layer.provide(dbLayer));
+const build = makeMcpBuildServer(Layer.merge(stack, pluginsLayer));
+const principal = {
+  accountId: "bench",
+  organizationId: "bench",
+  organizationName: "Bench",
+  email: "bench@example.test",
+  name: "Bench",
+  avatarUrl: null,
+  roles: ["user"],
+  orgRoleModel: "organization" as const,
+};
+const digest = (value: unknown) => createHash("sha256").update(JSON.stringify(value)).digest("hex");
+const hashes: Record<string, string> = {};
+const checkHash = (name: string, value: unknown) => {
+  const hash = digest(value);
+  if (hashes[name] !== undefined && hashes[name] !== hash) {
+    throw new Error(`Benchmark result changed between samples: ${name}`);
+  }
+  hashes[name] = hash;
+};
+const run = <A, E>(effect: Effect.Effect<A, E>) => Effect.runPromise(effect);
+try {
+  const seed = await run(
+    makeScopedExecutor<SelfHostPlugins>("bench", "bench", "Bench").pipe(
+      Effect.provide(SelfHostScopedExecutorSeams),
+      Effect.provide(dbLayer),
+    ),
+  );
+  for (const slug of ["cloudflare_api", "vercel_api"]) {
+    const fixture = slug === "cloudflare_api" ? "cloudflare" : "vercel";
+    await run(
+      seed.openapi.addSpec({
+        spec: {
+          kind: "blob",
+          value: readFileSync(
+            resolve(import.meta.dir, `../../../packages/plugins/openapi/fixtures/${fixture}.json`),
+            "utf8",
+          ),
+        },
+        slug,
+      }),
+    );
+    await run(
+      seed.connections.create({
+        owner: "org",
+        integration: IntegrationSlug.make(slug),
+        name: ConnectionName.make("main"),
+        template: AuthTemplateSlug.make("apiKey"),
+        value: "fixture-token",
+      }),
+    );
+  }
+  const tools = await run(seed.tools.list({ includeAnnotations: false }));
+  await run(seed.close());
+  for (let i = 0; i < samples; i++) {
+    const start = performance.now();
+    const built = await run(
+      build(principal, { mode: "passthrough", artifactsEnabled: false }).pipe(
+        Effect.withTracer(tracer),
+      ),
+    );
+    record("server.build", performance.now() - start);
+    const [ct, st] = InMemoryTransport.createLinkedPair();
+    const client = new Client({ name: "fixture-bench", version: "1" }, { capabilities: {} });
+    await built.mcpServer.connect(st);
+    try {
+      let start = performance.now();
+      await client.connect(ct);
+      record("client.initialize", performance.now() - start);
+      start = performance.now();
+      const listed = await client.listTools();
+      record("client.tools_list", performance.now() - start);
+      checkHash("tools", listed);
+      checkHash("instructions", client.getInstructions());
+      for (const [name, args] of [
+        ["filtered", { query: "dns record", integration: "cloudflare_api", limit: 3 }],
+        ["full", { query: "dns record", integration: "cloudflare_api", limit: 3, detail: "full" }],
+      ] as const) {
+        start = performance.now();
+        const result = await client.callTool({ name: "search", arguments: args });
+        record(`client.search.${name}`, performance.now() - start);
+        if (result.isError) throw new Error(JSON.stringify(result));
+        checkHash(name, result);
+      }
+    } finally {
+      await client.close();
+      await built.mcpServer.close();
+      await run(built.engine.shutdown);
+      if (built.executor) await run(built.executor.close());
+    }
+  }
+  const summary = Object.fromEntries(
+    Object.entries(phases).map(([name, times]) => {
+      const sorted = [...times].sort((a, b) => a - b);
+      return [
+        name,
+        {
+          n: times.length,
+          p50: sorted[Math.ceil(times.length * 0.5) - 1],
+          p95: sorted[Math.ceil(times.length * 0.95) - 1],
+        },
+      ];
+    }),
+  );
+  const result = {
+    catalogTools: tools.filter((t) => !t.static).length,
+    samples,
+    hashes,
+    summary,
+    phases,
+  };
+  writeFileSync(
+    process.env.BENCH_OUTPUT ?? join(tmpdir(), "executor-mcp-session-bench.json"),
+    JSON.stringify(result, null, 2),
+  );
+  console.log(JSON.stringify({ catalogTools: result.catalogTools, hashes, summary }, null, 2));
+} finally {
+  await db.close();
+  rmSync(dataDir, { recursive: true, force: true });
+}
+// The plugin transport pool has process timers. All benchmark-owned handles
+// are closed above; finish the standalone measurement process.
+process.exit(0);