Fix MCP file uploads without model encoding or sandbox credentials - #1528
Merged
Merged
Conversation
obsessixnv
added a commit
to ElcanoTek/pages
that referenced
this pull request
Sep 17, 2026
## What changed, and why Uploads built in a sealed or redacting agent runtime could stall because the instructions required a credential-bearing shell PUT or model-generated base64. Advertise `contentEncoding: base64` for upload chunks so capable clients can forward exact workspace file ranges. Prepared prompts and staging responses prefer that capability and preserve accepted chunks instead of encouraging cancel/restart loops. Ticket uploads remain available to other clients. A successful managed refresh also previously displayed an older blocked check beside its new timestamp. Return explicit latest-outcome fields and the historical check timestamp, and use them in the admin tooltip without deleting check history. Clarify that the 20 KB threshold selects transport and is not a server rejection limit. ## Validation - `npm test`: 279 passing. - `npm run test:browser`: 298 passing. - `bash test/run-integration.sh`: passing, including official MCP SDK capability discovery and refresh outcome ordering. - Shell syntax checks passing; production audit passes the repository's high-severity threshold (one existing moderate transitive advisory remains). File-reference expansion is implemented by ElcanoTek/fleet#1528; bundle instructions are updated in ElcanoTek/elcano-config#149. Pages continues to accept canonical base64 strings on the wire. Publication gates, source reconciliation and optimistic concurrency are unchanged. No live pages were refreshed during this work.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What changed, and why
MCP uploads could get stuck when the file lived in a sealed sandbox: shell PUTs required a ticket credential, while copying base64 through model output hit output suppression or truncation. Fleet now accepts a hash-bound workspace file reference for a top-level MCP string property explicitly annotated
contentEncoding: base64. Both interactive and scheduled runs read through sandbox FileOp, encode the exact byte range, and dispatch through the original scoped MCP broker after the existing approval and policy gates.Ticket responses also exposed a redaction bug: scrubbing an escaped Authorization example could corrupt the enclosing JSON and leave another copy of the bearer in an unfamiliar field. Structured JSON redaction now preserves framing and number precision and removes repeated bearer values without permanently retaining temporary credentials.
This is a generic engine capability; connector tool names, upload sequences, final publication and reconciliation remain server/bundle responsibilities. Companion adoption: ElcanoTek/pages#97 and https://github.com/ElcanoTek/elcano-config/pull/149. Upgrade those components and regenerate saved prompts to use the new path.
How you verified it
make ci-webpassed: audit, lint, typecheck, 1,674 tests and production build. Guides are synchronized./root; those failing cases passed after setting bothTMPDIRandGOTMPDIRto an accessible directory. The local browser retry was stopped after resource-related timing failures; CI's complete browser runs are green.make govulncheckpassed with no reachable vulnerabilities. All PR CI checks passed, including the full race suite, container-image vulnerability scan, CodeQL, Semgrep and the required CI gate. The redundant local race run was stopped after CI completed successfully to release this machine's resources.Scope and deviations
Shipped: opt-in top-level base64 arguments, whole-file SHA-256 binding, raw byte ranges, a 2 MiB whole-file cap, sandbox-only reads, shared dispatch and JSON-safe redaction. No host file fallback, direct HTTP uploader, credential export, connector special case or approval bypass. Larger streaming files, nested/JSON/text references and automatic multi-call upload orchestration are deliberately deferred. Design and boundaries are documented in
docs/MCP-WORKSPACE-FILES.mdand ADR-0066.