feat(adt-server): wire safe_execute hooks from environment URLs

[devin-ai-integration]

Summary

createAdtServerMcpOptions now provides sensible default consumeExecutionAuthorization and reportExecutionOutcome implementations when ADT_SERVER_MCP_SAFE_EXECUTE_ENABLED=true and explicit hooks are not supplied. Deployments only need to set two URLs:

• ADT_SERVER_MCP_AUTHORIZATION_CONSUMER_URL
• ADT_SERVER_MCP_OUTCOME_REPORTER_URL

Both endpoints receive a POST with the hook payload as JSON plus an Authorization: Bearer <authorizationToken> header. A non-2xx response is treated as a denied/rejected outcome.

If either URL is missing (and no explicit hook is passed), startup still aborts with the existing deployment-owned authorization and outcome hooks error, preserving the fail-closed behavior.

Also updates docker-entrypoint.adt-server.sh to unset the new env vars when ADT_SERVER_MCP_ENABLED=false, so disabled MCP does not accidentally leave orphaned safe_execute settings.

Verification

• node --import tsx --test packages/adt-server/tests/mcp-runtime.test.ts — 13/13 passing
• bunx nx lint adt-server — passing
• bunx nx build adt-server — passing

Relates to #144.

Link to Devin session: https://app.devin.ai/sessions/287b8498d06b43dbb42f08caa958d478
Requested by: @ThePlenkov

---

Summary by cubic

Adds HTTP-based default safe_execute hooks to adt-server so deployments can provide two URLs instead of custom hook code. Preserves fail-closed startup and cleans up safe_execute env vars when MCP is disabled.

• New Features

  • Auto-wires consumeExecutionAuthorization and reportExecutionOutcome from ADT_SERVER_MCP_AUTHORIZATION_CONSUMER_URL and ADT_SERVER_MCP_OUTCOME_REPORTER_URL when ADT_SERVER_MCP_SAFE_EXECUTE_ENABLED=true and no explicit hooks are passed.
  • Sends POST JSON with an Authorization Bearer header; non-2xx responses are treated as denied/rejected.
  • Startup still fails if either URL is missing when safe_execute is enabled.
  • Docker entrypoint unsets the new env vars when ADT_SERVER_MCP_ENABLED=false.

• Migration

  • To use defaults, set both URLs and enable ADT_SERVER_MCP_SAFE_EXECUTE_ENABLED=true. Otherwise, provide custom hooks.
  • No changes needed if MCP is disabled.

^{Written for commit 340ddf4. Summary will update on new commits.}

[devin-ai-integration]

Original prompt from Petr

#144 @skills:triage-issue

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR that start with 'DevinAI' or '@devin'.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[netlify]

✅ Deploy Preview for adt-cli canceled.

Name	Link
🔨 Latest commit	340ddf4
🔍 Latest deploy log	https://app.netlify.com/projects/adt-cli/deploys/6a6392a25e169700086346be

[nx-cloud]

View your CI Pipeline Execution ↗ for commit 340ddf4

Command	Status	Duration	Result
nx affected -t lint test build e2e-ci --verbose...	✅ Succeeded	12s	View ↗

💡 Verify your cache is correct by running tasks in a sandbox. Read docs ↗

---

☁️ Nx Cloud last updated this comment at 2026-07-24 16:29:14 UTC

[sonarqubecloud]

Quality Gate passed

Issues
1 New issue
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 19 complexity · 10 duplication

Metric	Results
Complexity	19
Duplication	10

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.}

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.