Let an AI agent see the open editor through MCP (#429)

Claude Code should be able to work inside the user's open editor tab.
This first stage connects the two and lets the agent look: what the
user sees and a picture of it. Changing the project comes in stage 2.

- An agent token per account opens only /mcp, no API route. The
  dialog "Agent tokens..." in the account menu creates it once, shows
  the ready "claude mcp add" line and revokes it. The server keeps
  only its sha256 (api/lib/AgentTokens.php).
- Wrong tokens count into the sign-in brake from #427. Changing the
  password, renaming or deleting an account ends its tokens.
- The relay (tools/mcp/) is a small Node service without packages,
  WebSocket server included. It runs in the container feuerwerk-mcp
  because PHP-FPM cannot hold connections. Whether a token or a tab
  ticket is valid is still decided by the PHP API, through two routes
  that answer only with the relay key.
- The tab joins over WebSocket on the same origin with the normal
  session, an Origin check and a one-time ticket. It connects only
  after "Agent" is switched on in the account menu. One tab per
  account is active, a new one takes over. Guests get nothing.
- Tools: get_view (project, tab, document, selection with names,
  camera, play state, open dialog) and screenshot. The resource
  feuerwerk://view can be subscribed. Claude Code does not act on
  that reliably, so a changed view is also noted on the next answer.
- A badge next to the account menu shows the connected agents. It
  counts only agents with an open stream or a request in the last
  two minutes.
- CI starts the relay in front of php -S (tools/ci/serve.sh), and
  e2e 71 runs the whole path in the browser.

Found on the live test: the badge showed four agents because old
sessions of revoked tokens were still counted.

Tests:
- Gate on atx: 316 files, 4888 tests
- relay protocol test with fake API and fake tabs: 23/23
- get_view, tools, socketUrl: 16/16
- PHP agents 29, rights 103 checks
- e2e 71 on atx 10/10, against the live site 10/10, no CSP violation
- real Claude Code against the live site: get_view answered
- ZAP against /mcp: nothing at High or Medium
- every new check fails when the guard it covers is taken out (6)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tools/ci/serve.sh

@@ -2,10 +2,13 @@
 # Sourced, not run: it leaves the PHP server in the caller's background and exports
 # FEUERWERK_BASE_URL, which every tool reads.
 #
-# The build wires its assets absolutely under /feuerwerk/dist/, so the checkout has to be
-# served under that path segment – hence the symlink into /srv rather than `-t .`.
+# The checkout is served under /feuerwerk/ like on stein2 – hence the symlink into /srv rather
+# than `-t .`.
 
 export FEUERWERK_BASE_URL=http://127.0.0.1:8080/feuerwerk/
+# The MCP relay (#429) in front of the same server, so the editor's tab reaches it on its own
+# origin as it does behind nginx on stein2. Only step 71 opens the editor there.
+export FEUERWERK_MCP_BASE_URL=http://127.0.0.1:8081/feuerwerk/
 
 feuerwerk_serve() {
   local root
@@ -30,11 +33,17 @@ feuerwerk_serve() {
     echo >>"$root/data/e2e-admin-password.txt"
   fi
   php "$root/tools/make-user.php" e2e-admin "$(cat "$root/data/e2e-admin-password.txt")" admin
+  # The key the relay asks the API with.
+  if [ ! -f "$root/data/mcp-relay.key" ]; then
+    head -c 32 /dev/urandom | od -An -tx1 | tr -d ' \n' >"$root/data/mcp-relay.key"
+    echo >>"$root/data/mcp-relay.key"
+  fi
 
   # A server from an earlier step of the same job is fine to keep. Asked of the one route that
   # answers without a session, so "is it up" does not depend on being signed in.
   if curl -sf "${FEUERWERK_BASE_URL}api/index.php?r=auth/session" >/dev/null 2>&1; then
     echo "server already up at $FEUERWERK_BASE_URL"
+    feuerwerk_relay "$root"
     return 0
   fi
 
@@ -56,4 +65,24 @@ feuerwerk_serve() {
     return 1
   fi
   echo "serving $root at $FEUERWERK_BASE_URL"
+  feuerwerk_relay "$root"
+}
+
+# Starts the relay unless it answers already: without a token it says 401.
+feuerwerk_relay() {
+  local root=$1
+  local mcp="${FEUERWERK_MCP_BASE_URL}mcp"
+  [ "$(curl -s -o /dev/null -w '%{http_code}' -X POST "$mcp")" = 401 ] && return 0
+  FEUERWERK_MCP_API="${FEUERWERK_BASE_URL}api/index.php" \
+    FEUERWERK_MCP_ORIGINS=http://127.0.0.1:8081 \
+    FEUERWERK_MCP_HOST=127.0.0.1 FEUERWERK_MCP_PORT=8081 \
+    FEUERWERK_MCP_BACKEND=http://127.0.0.1:8080 \
+    node "$root/tools/mcp/serve.mjs" >/tmp/mcp-relay.log 2>&1 &
+  for _ in $(seq 40); do
+    [ "$(curl -s -o /dev/null -w '%{http_code}' -X POST "$mcp")" = 401 ] && return 0
+    sleep 0.25
+  done
+  echo "the MCP relay never came up" >&2
+  tail -20 /tmp/mcp-relay.log >&2
+  return 1
 }