fix(server): parent spawned threads to their native subagent

apps/server/src/mcp/McpHttpServer.test.ts

@@ -955,6 +955,43 @@ it.effect("admits provider and OAuth client credentials and points only clients
       const deadProvider = yield* call("deadProviderToken");
       expect(deadProvider.status).toBe(401);
       expect(deadProvider.headers["www-authenticate"]).toBe('Bearer error="invalid_token"');
+
+      // Each call's own `_meta` names its agent; the session's initialize `_meta` never does.
+      seen.length = 0;
+      const headers = {
+        accept: "application/json, text/event-stream",
+        authorization: `Bearer ${providerToken}`,
+      };
+      const initialize = yield* httpClient.post("/mcp", {
+        headers,
+        body: HttpBody.text(
+          `{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-06-18","capabilities":{},"clientInfo":{"name":"probe","version":"1.0.0"},"_meta":{"claudecode/toolUseId":"toolu-initialize"}}}`,
+          "application/json",
+        ),
+      });
+      for (const [id, meta] of [
+        [2, `,"_meta":{"claudecode/toolUseId":"toolu-first"}`],
+        [3, `,"_meta":{"threadId":"codex-native-thread","callId":"call-1"}`],
+        [4, ""],
+      ] as const) {
+        const called = yield* httpClient.post("/mcp", {
+          headers: {
+            ...headers,
+            "mcp-session-id": initialize.headers["mcp-session-id"]!,
+            "mcp-protocol-version": "2025-06-18",
+          },
+          body: HttpBody.text(
+            `{"jsonrpc":"2.0","id":${id},"method":"tools/call","params":{"name":"probe","arguments":{}${meta}}}`,
+            "application/json",
+          ),
+        });
+        expect(called.status).toBe(200);
+      }
+      expect(seen.map((scope) => scope.thread?.nativeCallId)).toEqual([
+        "claude-tool:toolu-first",
+        "codex-thread:codex-native-thread",
+        undefined,
+      ]);
     }),
   ).pipe(Effect.provide(NodeHttpServer.layerTest)),
 );

apps/server/src/mcp/McpHttpServer.ts

@@ -1022,6 +1022,54 @@ const withToolAnalytics =
     return yield* registration.pipe(Effect.provideService(McpServer.McpServer, recordingServer));
   });
 
+/** The provider's per-call agent id. Claude names the tool call; Codex names its thread. */
+const nativeCallIdFromMetadata = (metadata: unknown): string | undefined => {
+  if (typeof metadata !== "object" || metadata === null) return undefined;
+  const fields = metadata as Readonly<Record<string, unknown>>;
+  const toolUseId = fields["claudecode/toolUseId"];
+  if (typeof toolUseId === "string" && toolUseId.length > 0) return `claude-tool:${toolUseId}`;
+  const threadId = fields.threadId;
+  if (typeof threadId === "string" && threadId.length > 0) return `codex-thread:${threadId}`;
+  return undefined;
+};
+
+/**
+ * Stateful MCP sessions give `McpRequestContext` the initialize `_meta`; each call's own `_meta`
+ * is on `McpServerClient`. The call id rides on the thread caller for delegation to verify.
+ */
+const withNativeCallIds = Effect.fn("McpHttpServer.withNativeCallIds")(function* <A, E, R>(
+  registration: Effect.Effect<A, E, R>,
+) {
+  const server = yield* McpServer.McpServer;
+  const identifyingServer = McpServer.McpServer.of({
+    ...server,
+    addTool: Effect.fn("McpServer.addTool")(function (options) {
+      return server.addTool({
+        ...options,
+        handle: (payload) =>
+          Effect.withFiber((fiber) => {
+            const invocation = Context.getOrUndefined(
+              fiber.context,
+              McpInvocationContext.McpInvocationContext,
+            );
+            const nativeCallId = nativeCallIdFromMetadata(
+              Context.getOrUndefined(fiber.context, McpSchema.McpServerClient)?.requestMetadata,
+            );
+            return nativeCallId === undefined || invocation?.thread === undefined
+              ? options.handle(payload)
+              : options.handle(payload).pipe(
+                  Effect.provideService(McpInvocationContext.McpInvocationContext, {
+                    ...invocation,
+                    thread: { ...invocation.thread, nativeCallId },
+                  }),
+                );
+          }),
+      });
+    }),
+  });
+  return yield* registration.pipe(Effect.provideService(McpServer.McpServer, identifyingServer));
+});
+
 /** `McpServer.registerToolkit` advertises the full codec schema; agents get the compact one. */
 const withAdvertisedSchemas = Effect.fn("McpHttpServer.withAdvertisedSchemas")(function* <
   Tools extends Record<string, Tool.Any>,
@@ -1074,7 +1122,9 @@ export const toolkitRegistration = <Tools extends Record<string, Tool.Any>, EX,
 ) =>
   Layer.effectDiscard(
     withToolAnalytics(
-      withAdvertisedSchemas(toolkit, McpServer.registerToolkit(decodeAsAdvertised(toolkit))),
+      withNativeCallIds(
+        withAdvertisedSchemas(toolkit, McpServer.registerToolkit(decodeAsAdvertised(toolkit))),
+      ),
     ),
   ).pipe(
     Layer.provide(

apps/server/src/mcp/McpInvocationContext.ts

@@ -29,6 +29,11 @@ export interface McpThreadCaller {
   readonly providerInstanceId: ProviderInstanceId;
   /** A delegated child task; its parent owns the work it hands back. */
   readonly subagent?: boolean;
+  /**
+   * The provider's id for this call's agent (a Claude tool call, a Codex thread), from the
+   * call's `_meta`. Only an adapter binding for this credential turns it into a native caller.
+   */
+  readonly nativeCallId?: string;
 }
 
 export interface McpClientCaller {