Add workspace key bootstrap and keyless startup

[willwashburn]

Introduce workspace key support and keyless startup flow: session now stores workspaceKey and createInitialSession accepts an optional key. Add two new registration tools (create_workspace, set_workspace_key) to bootstrap or switch workspace keys; switching clears any existing agent identity. create_workspace calls the Relay API (via fetch) and stores the returned api_key in session.

Make MCP server tolerant of missing RELAY_API_KEY at startup: stdio no longer exits if env var missing, createRelayMcpServer accepts an optional apiKey and lazily constructs Relay clients using the session's workspaceKey or agentToken. getRelay now throws instructive error when workspace key is not configured, and agent websocket bridge handling is improved to reset/reinitialize when agent tokens change. Piggybacking skips include the new workspace tools. Update system prompt and README to document keyless flow. Tests updated/added to cover create_workspace, set_workspace_key, register behavior and keyless startup; tool count expectations adjusted.

---

[devin-ai-integration]

Devin Review found 1 potential issue.

View 6 additional findings in Devin Review.

[devin-ai-integration]

🟡 nextAgentName uses ?? instead of explicit null check, failing to clear agent name

On packages/mcp/src/server.ts:58, nextAgentName is computed using ??, which treats explicit null the same as undefined and falls through to the old session value. This is inconsistent with the nextAgentToken computation on line 56-57, which correctly distinguishes between undefined (not provided) and null (explicitly cleared).

Root Cause and Impact

When setSession({ workspaceKey: 'rk_new', agentToken: null, agentName: null }) is called (from create_workspace at packages/mcp/src/tools/registration.ts:74 or set_workspace_key at line 100), the intent is to clear the agent identity. However:

const nextAgentName = partial.agentName ?? session.agentName ?? null;
// partial.agentName is null → nullish → falls back to session.agentName
// Result: 'old-agent' instead of null

Compare with the correct pattern used for nextAgentToken:

const nextAgentToken =
  partial.agentToken === undefined ? session.agentToken : partial.agentToken;
// partial.agentToken is null → not undefined → uses null
// Result: null (correct)

nextAgentName is consumed by the telemetry event at line 89. In current call sites this telemetry line is only reached when nextAgentToken is truthy (bridge initialization), and all current callers that set agentName: null also set agentToken: null, so the stale value isn't emitted yet. However, the calculation is incorrect and any future call site that sets agentName: null with a truthy agentToken would log the wrong agent name.

Suggested change

	const nextAgentName = partial.agentName ?? session.agentName ?? null;
	const nextAgentName = partial.agentName === undefined ? (session.agentName ?? null) : partial.agentName;

---

Was this helpful? React with 👍 or 👎 to provide feedback.