fix(vtex): read MESH_REQUEST_CONTEXT per-request, not from cached factory env

vtex/package.json

@@ -18,16 +18,16 @@
     "test": "bun test"
   },
   "dependencies": {
-    "@decocms/bindings": "^1.3.1",
-    "@decocms/runtime": "1.3.1",
+    "@decocms/bindings": "^1.4.0",
+    "@decocms/runtime": "^1.6.2",
+    "@modelcontextprotocol/sdk": "^1.27.1",
     "zod": "^4.0.0"
   },
   "devDependencies": {
     "@cloudflare/workers-types": "^4.20260206.0",
     "@decocms/mcps-shared": "1.0.0",
     "@hey-api/client-fetch": "^0.8.0",
     "@hey-api/openapi-ts": "0.92.4",
-    "@modelcontextprotocol/sdk": "1.20.2",
     "@types/bun": "^1.2.14",
     "deco-cli": "^0.28.0",
     "typescript": "^5.7.2"

vtex/server/lib/tool-adapter.ts

@@ -291,28 +291,22 @@ export interface ToolFromOperationConfig {
 export function createToolFromOperation(config: ToolFromOperationConfig) {
   const flatInput = flattenRequestSchema(config.requestSchema);
 
-  return (env: Env) =>
+  // The factory's `env` is captured ONCE when the runtime resolves tool
+  // registrations on the first request, then cached for the process lifetime
+  // (see @decocms/runtime tools.ts: `let cached: Registrations | null`).
+  // Reading `env.MESH_REQUEST_CONTEXT` from this closure pins every tool call
+  // to the FIRST request's context — so an unauthenticated tools/list at pod
+  // start would poison every subsequent state read with `state: {}`.
+  // Read per-request env from `runtimeContext` instead — the runtime fills
+  // it from AsyncLocalStorage on every execute call.
+  return (_env: Env) =>
     createTool({
       id: config.id,
       description: config.description,
       annotations: config.annotations,
       inputSchema: flatInput,
-      execute: async ({ context }) => {
-        const meshCtx = env.MESH_REQUEST_CONTEXT;
-        console.log(
-          `[VTEX] tool=${config.id} mesh-context-shape:`,
-          JSON.stringify({
-            hasMeshContext: Boolean(meshCtx),
-            hasToken: Boolean(meshCtx?.token),
-            hasConnectionId: Boolean(meshCtx?.connectionId),
-            hasMeshUrl: Boolean(meshCtx?.meshUrl),
-            stateKeys: meshCtx?.state ? Object.keys(meshCtx.state) : [],
-            stateAccountNamePresent: Boolean(
-              (meshCtx?.state as { accountName?: unknown } | undefined)
-                ?.accountName,
-            ),
-          }),
-        );
+      execute: async ({ context, runtimeContext }) => {
+        const meshCtx = (runtimeContext.env as Env).MESH_REQUEST_CONTEXT;
         const creds = resolveCredentials(meshCtx?.state);
         assertValidCredentials(creds, config.id);
         const factory = config.clientFactory ?? createVtexClient;

vtex/server/tools/custom/reorder-collection.ts

@@ -267,14 +267,18 @@ async function uploadCollectionFile(params: {
   }
 }
 
-export const reorderCollection = (env: Env) =>
+// Read per-request env from `runtimeContext` — see comment in
+// lib/tool-adapter.ts for why the factory's captured env is unsafe to read
+// inside execute (cached registrations + fresh per-request bindings).
+export const reorderCollection = (_env: Env) =>
   createTool({
     id: "VTEX_REORDER_COLLECTION",
     description:
       "Overwrite collection contents by removing current SKUs and importing a new ordered SKU list via spreadsheet file.",
     inputSchema: reorderCollectionInputSchema,
     outputSchema: reorderCollectionOutputSchema,
-    execute: async ({ context }) => {
+    execute: async ({ context, runtimeContext }) => {
+      const env = runtimeContext.env as Env;
       const reorderPromise = (async () => {
         const credentials = resolveCredentials(env.MESH_REQUEST_CONTEXT?.state);
         assertValidCredentials(credentials, "VTEX_REORDER_COLLECTION");

vtex/server/tools/custom/search-collections.ts

@@ -2,15 +2,19 @@ import { createTool } from "@decocms/runtime/tools";
 import { z } from "zod";
 import type { Env } from "../../types/env.ts";
 
-export const searchCollections = (env: Env) =>
+// Read per-request env from `runtimeContext` — see comment in
+// lib/tool-adapter.ts for why the factory's captured env is unsafe to read
+// inside execute (cached registrations + fresh per-request bindings).
+export const searchCollections = (_env: Env) =>
   createTool({
     id: "VTEX_SEARCH_COLLECTIONS",
     description: "Search collections by name or other terms.",
     annotations: { readOnlyHint: true },
     inputSchema: z.object({
       searchTerms: z.string().describe("Search terms to find collections"),
     }),
-    execute: async ({ context }) => {
+    execute: async ({ context, runtimeContext }) => {
+      const env = runtimeContext.env as Env;
       const credentials = env.MESH_REQUEST_CONTEXT.state;
       const { accountName, appKey, appToken } = credentials;
 

vtex/server/tools/custom/update-product-specifications.ts

@@ -39,14 +39,18 @@ const outputSchema = z.object({
   productId: z.number().int().positive(),
 });
 
-export const updateProductSpecifications = (env: Env) =>
+// Read per-request env from `runtimeContext` — see comment in
+// lib/tool-adapter.ts for why the factory's captured env is unsafe to read
+// inside execute (cached registrations + fresh per-request bindings).
+export const updateProductSpecifications = (_env: Env) =>
   createTool({
     id: "VTEX_UPDATE_PRODUCT_SPECIFICATIONS",
     description:
       "Replace all specifications for a product. Pass the complete set — values not included are removed. Caller does GET → merge → POST for partial updates. Counterpart of VTEX_GET_PRODUCT_SPECIFICATIONS.",
     inputSchema,
     outputSchema,
-    execute: async ({ context }) => {
+    execute: async ({ context, runtimeContext }) => {
+      const env = runtimeContext.env as Env;
       const credentials = resolveCredentials(env.MESH_REQUEST_CONTEXT?.state);
       assertValidCredentials(credentials, "VTEX_UPDATE_PRODUCT_SPECIFICATIONS");
       const url = `https://${credentials.accountName}.vtexcommercestable.com.br/api/catalog_system/pvt/products/${context.productId}/specification`;