Function fetch

apps/local/src/serve.ts:379–472

(req)

      idleTimeout: 0,
      routes: { ...staticRoutes },
      async fetch(req) {
        const withCors = (response: Response): Response =>
          withCorsHeaders(req, response, corsAllowedHosts);

        if (req.method === "OPTIONS" && req.headers.has("origin")) {
          return corsPreflightResponse(req, corsAllowedHosts);
        }

        const url = new URL(req.url);

        // Unauthenticated liveness probe — carries no data, used by the CLI
        // reachability check (which therefore never forwards a credential).
        if (url.pathname === "/api/health" && req.method === "GET") {
          return withCors(new Response("ok", { headers: { "content-type": "text/plain" } }));
        }

        // OAuth callbacks and CIMD documents are reached by the external
        // provider, which cannot carry our local bearer. Everything else under
        // /api and /mcp requires the bearer.
        const skipAuth = isUnauthenticatedOAuthPath(url.pathname);
        const isMcpPath = url.pathname === "/mcp" || url.pathname.startsWith("/mcp/");
        const isGatedSurface = url.pathname.startsWith("/api") || isMcpPath;

        if (isGatedSurface && !skipAuth && !isAuthorized(req)) {
          return withCors(
            new Response("Unauthorized", {
              status: 401,
              headers: { "www-authenticate": 'Bearer realm="executor"' },
            }),
          );
        }

        if (isUnauthenticatedOAuthClientMetadataPath(url.pathname) && req.method === "GET") {
          return withCors(oauthClientMetadataResponse(`${url.pathname}${url.search}`, req));
        }

        if (isMcpPath) {
          return withCors(await handlers.mcp.handleRequest(req));
        }

        if (url.pathname.startsWith("/api/mcp-sessions/")) {
          // GET → paused-execution detail for the approval page; POST → record the
          // decision. Both are bearer-gated above.
          const handler =
            req.method === "GET"
              ? handlers.mcp.handlePausedRequest
              : handlers.mcp.handleApprovalRequest;
          return withCors(await handler(req));
        }

        // OAuth result polling — local-only, served outside the typed API
        // because cloud (Cloudflare Workers, stateless) can't back the
        // in-memory store. See setOAuthCompletionListener above.
        const awaitMatch = /^\/api\/oauth\/await\/([^/?#]+)$/.exec(url.pathname);
        if (awaitMatch && req.method === "GET") {
          const result = consumeOAuthResult(awaitMatch[1]);
          return withCors(
            new Response(JSON.stringify(result), {