feat(mcp): mount /mcp Streamable HTTP endpoint

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

tests/mcp/mcp_http.test.js

@@ -0,0 +1,39 @@
+import { describe, it, expect, beforeAll } from 'vitest';
+import request from 'supertest';
+import { setup } from '../api/helpers.js';
+import * as agentsRepo from '../../lib/db/repos/agents.js';
+import { pool } from '../../lib/db/pool.js';
+
+let app, ownerHeaders, scopedToken;
+const owner = { kind: 'user', id: null };
+const ACCEPT = 'application/json, text/event-stream';
+const init = {
+  jsonrpc: '2.0', id: 1, method: 'initialize',
+  params: { protocolVersion: '2025-03-26', capabilities: {}, clientInfo: { name: 't', version: '1' } }
+};
+
+beforeAll(async () => {
+  ({ app, ownerHeaders } = await setup());
+  const { rows: [{ id: spaceId }] } = await pool.query(`INSERT INTO spaces(slug,name) VALUES('s','S') RETURNING id`);
+  const agent = await agentsRepo.create({ slug: `m-${Date.now()}`, name: 'M', kind: 'claude', model: 'sonnet',
+    capabilities: { read: true, suggest: true }, scopes: { space_id: spaceId } }, owner);
+  ({ token: scopedToken } = await agentsRepo.createToken(agent.id, 'mcp'));
+});
+
+describe('POST /mcp', () => {
+  it('no bearer → 401', async () => {
+    const res = await request(app).post('/mcp').set('Accept', ACCEPT).send(init);
+    expect(res.status).toBe(401);
+  });
+  it('owner token → 401 agent_required', async () => {
+    const res = await request(app).post('/mcp').set(ownerHeaders).set('Accept', ACCEPT).send(init);
+    expect(res.status).toBe(401);
+    expect(res.body.error.code).toBe('agent_required');
+  });
+  it('scoped agent initialize → 200 with serverInfo', async () => {
+    const res = await request(app).post('/mcp')
+      .set('Authorization', `Bearer ${scopedToken}`).set('Accept', ACCEPT).send(init);
+    expect(res.status).toBe(200);
+    expect(res.body.result.serverInfo.name).toBe('void-external');
+  });
+});